account

Named accounts hold a profile directory, provider API key, or Claude OAuth token. Workspaces must explicitly authorize them with workspace account.

account list and account scan

jackin account list
jackin account scan

The first start scans all supported agents' default credential locations and nonempty provider API-key environment variables. scan repeats discovery and imports newly found sources, including CLAUDE_CODE_OAUTH_TOKEN subscription references. Kimi also checks ~/.kimi when ~/.kimi-code has no credentials. API-key discovery accepts the supported coding-plan aliases, including KIMI_CODE_API_KEY, Z_AI_API_KEY, and MINIMAX_CODING_API_KEY. Neither command prints credential values. Empty directories and configuration files without credential evidence are not accounts.

account add

jackin account add claude-work --name "Work Claude" \
  --agent claude --directory ~/.claude-work
jackin account add openai-work --provider openai --api-key
jackin account add zai-work --provider zai --api-key \
  --secret-ref '$ZAI_API_KEY' --model glm-5.1
jackin account add claude-token --agent claude --oauth-token \
  --secret-ref 'op://Work/Claude/oauth-token'

Choose exactly one credential source:

Without --stdin or --secret-ref, key/token input uses a masked prompt. Supported providers are anthropic, openai, amp, xai, opencode, moonshot, zai, and minimax. Profile agents are claude, codex, amp, kimi, opencode, and grok.

The account ID uses lowercase letters, digits, and hyphens. Keep aliases pointing at different logins as distinct account IDs. Amp accepts either its credential directory or an alias root containing data/amp/secrets.json and config/amp/settings.json.

Authorize the account

jackin workspace account assign my-app claude-work
jackin workspace account select my-app claude-work --agent claude

Registering credentials alone grants no workspace access.

Enable, disable, and choose defaults

jackin account disable claude-work
jackin account enable claude-work
jackin account default claude-work --agent claude

Disabled accounts remain registered but cannot authenticate new launches or supply usage credentials. A default selects an account for one agent; it never grants workspace access. Workspaces must still authorize the account ID. Duplicate credential sources are rejected when adding or editing an account.

In Settings → Accounts, select an account and press E to toggle it, or F to choose the agent whose default should change.

account remove

jackin account remove claude-work

Removes the registry entry and every assignment and binding referring to it. The underlying profile directory and provider credential remain untouched. Revoke the upstream key/token through its provider when that is also required.