anycloud credentials

Manage named provider credentials. Alias: anycloud creds.

anycloud credentials new [name] [provider options]
anycloud credentials list [--json]
anycloud credentials edit <name> [provider options]
anycloud credentials delete [name] [--force]

Option	Applies to	Description
--provider aws|azure|gcp|lambda|vast	new	Select the provider without the interactive picker
--overwrite	new	Replace an existing credential with the same name
--access-key-id, --secret-access-key	new,edit	Set AWS fields
--application-id, --secret	new,edit	Set Azure application fields
--subscription-id, --directory-id	new,edit	Set Azure account fields
--project-id, --client-email	new,edit	Set GCP service-account fields
--private-key	new,edit	Set the GCP service-account private key
--key-file PATH	edit	Read replacement GCP service-account fields from a JSON key file
--api-key	new,edit	Set a Lambda Labs or Vast.ai key (edit currently supports Lambda)
--json	list	[{name, cloudProvider}]; never includes secret values
-f, --force	delete	Delete even when a non-terminal deployment references the credential

With missing provider arguments in a terminal, new opens a wizard. The wizard can inspect local provider profiles, open a browser login, create a least-privilege identity, or accept pasted values.

edit requires an existing name and updates only the provider fields supplied as flags; it does not open a wizard or change the provider. delete without a name opens a picker in a terminal. Deletion is blocked while a non-terminal deployment references the credential unless --force is supplied.

Non-interactive provider fields

# AWS
anycloud credentials new production-aws \
  --provider aws \
  --access-key-id AKIA... \
  --secret-access-key ...

# Azure service principal
anycloud credentials new production-azure \
  --provider azure \
  --application-id ... \
  --secret ... \
  --subscription-id ... \
  --directory-id ...

# GCP service account
anycloud credentials new production-gcp \
  --provider gcp \
  --project-id my-project \
  --client-email service-account@my-project.iam.gserviceaccount.com \
  --private-key "..."

# Lambda
anycloud credentials new production-lambda \
  --provider lambda \
  --api-key ...

# Vast.ai
anycloud credentials new production-vast \
  --provider vast \
  --api-key ...

Secret provider fields accept their documented environment fallbacks; an explicit CLI flag wins when creating credentials. edit uses explicit flags only. Azure CLI authentication represents a user session, not an existing service-principal secret, so the wizard can create a service principal from that login but cannot recover an existing secret from it.

For selection precedence and storage identities, see Cloud Credentials and Configuration.