anycloud credentials

Manage named provider credentials. Alias: anycloud creds.

anycloud credentials new [name] [provider options]
anycloud credentials list [--json]
anycloud credentials edit <name> [provider options]
anycloud credentials delete [name] [--force]

Option	Applies to	Description
--provider aws|azure|gcp|lambda|vast	new	Select the provider without the interactive picker
--profile NAME	new	Import durable static keys from a named AWS profile
--generate	new	Explicitly create an Azure service principal using the authenticated Azure CLI
--overwrite	new	Replace an existing credential with the same name
--access-key-id, --secret-access-key	new,edit	Set AWS fields
--application-id, --secret	new,edit	Set Azure application fields
--subscription-id, --directory-id	new,edit	Set Azure account fields
--project-id, --client-email	new,edit	Set GCP service-account fields
--private-key	new,edit	Set the GCP service-account private key
--key-file PATH	edit	Read replacement GCP service-account fields from a JSON key file
--api-key	new,edit	Set a Lambda Labs or Vast.ai key
--json	list	[{name, cloudProvider}]; never includes secret values
-f, --force	delete	Delete even when a non-terminal deployment references the credential

With missing provider arguments in a terminal, new opens a wizard. Provider flows can inspect local profiles or key files, use Azure tooling, or accept pasted values. AWS and GCP onboarding only import existing durable material; Azure additionally offers explicit service-principal creation.

edit requires an existing name and updates only the provider fields supplied as flags; it does not open a wizard or change the provider. delete without a name opens a picker in a terminal. Deletion is blocked while a non-terminal deployment references the credential unless --force is supplied.

Non-interactive provider fields

# AWS
anycloud credentials new production-aws \
  --provider aws \
  --access-key-id AKIA... \
  --secret-access-key ...

# Import durable keys from a named AWS profile
anycloud credentials new production-aws \
  --provider aws \
  --profile production

# Azure service principal
anycloud credentials new production-azure \
  --provider azure \
  --application-id ... \
  --secret ... \
  --subscription-id ... \
  --directory-id ...

# Create an Azure service principal through an authenticated Azure CLI
anycloud credentials new production-azure \
  --provider azure \
  --generate

# GCP service account
anycloud credentials new production-gcp \
  --provider gcp \
  --project-id my-project \
  --client-email service-account@my-project.iam.gserviceaccount.com \
  --private-key "..."

# Lambda
anycloud credentials new production-lambda \
  --provider lambda \
  --api-key ...

# Vast.ai
anycloud credentials new production-vast \
  --provider vast \
  --api-key ...

Secret provider fields accept their documented environment fallbacks; an explicit CLI flag wins when creating credentials. edit uses explicit flags only. Azure CLI authentication represents a user session, not an existing service-principal secret, so the wizard can create a service principal from that login but cannot recover an existing secret from it.

For AWS, importable profiles must contain a durable access-key ID and secret in the shared credentials or config file. SSO, role, web-identity, credential-process, and session-token profiles cannot be saved because their credentials rotate or expire. Anycloud does not run aws configure sso, use those profiles to create IAM users, or support AWS --generate.

GCP import requires a service-account key JSON file or explicit service-account fields. A gcloud user login or user ADC cannot be imported and does not trigger service-account creation. AWS and GCP credentials generated by older Anycloud versions remain ordinary stored credentials; Anycloud does not delete their provider resources.

Before saving imported, pasted, or environment-provided AWS keys, Anycloud calls STS with those exact keys. This proves their identity, not broad EC2, S3, IAM, quota, or organization-policy access.

For selection precedence and storage identities, see Cloud Credentials and Configuration.