AgentClash
K

Guides

Configure Runtime Resources

Create secrets, provider accounts, runtime profiles, and model-backed deployments in the order the current product expects.

Goal: assemble the resource chain that turns a ready build version into a runnable deployment.

Prerequisites:

  • You already selected a workspace.
  • You already have an agent_build_id and a ready build_version_id.
  • You have the provider credential you intend to use.

1. Store provider credentials as workspace secrets

To manage the secret explicitly, set it first:

bash
1printf '%s' "$OPENAI_API_KEY" | agentclash secret set OPENAI_API_KEY
2agentclash secret list

The list endpoint returns metadata only. Secret values are not exposed back to you.

2. Create a provider account

There are two ways to do this.

Pattern A: reference an existing workspace secret

provider-account.json:

json
1{
2  "provider_key": "openai",
3  "name": "OpenAI Workspace Account",
4  "credential_reference": "workspace-secret://OPENAI_API_KEY",
5  "limits_config": {
6    "rpm": 60
7  }
8}

Create it:

bash
agentclash infra provider-account create --from-file provider-account.json

Pattern B: pass api_key directly on creation

json
1{
2  "provider_key": "openai",
3  "name": "OpenAI Workspace Account",
4  "api_key": "<PASTE_KEY_HERE>"
5}

The current infrastructure manager does not keep that raw value on the account row. It stores the key as a workspace secret and rewrites the provider account to use a workspace-secret://... credential reference automatically.

3. Choose a provider model

List the models available through the connected provider account:

bash
agentclash infra provider-account models <PROVIDER_ACCOUNT_ID>

Keep the exact model ID returned by the provider. You will pass it directly to deployment creation.

4. Create a runtime profile

A runtime profile controls execution target and limits.

runtime-profile.json:

json
1{
2  "name": "default-native",
3  "execution_target": "native",
4  "trace_mode": "full",
5  "max_iterations": 24,
6  "max_tool_calls": 32,
7  "step_timeout_seconds": 120,
8  "run_timeout_seconds": 1800,
9  "profile_config": {
10    "sandbox": {
11      "allow_shell": true,
12      "allow_network": false
13    }
14  }
15}

Create it:

bash
agentclash infra runtime-profile create --from-file runtime-profile.json

5. Create the deployment

The current deployment create contract requires:

  • name
  • agent_build_id
  • build_version_id
  • runtime_profile_id

Optional but commonly useful:

  • provider_account_id
  • model

Fast path with flags:

bash
1agentclash deployment create \
2  --name support-bot-prod \
3  --agent-build-id <AGENT_BUILD_ID> \
4  --build-version-id <BUILD_VERSION_ID> \
5  --runtime-profile-id <RUNTIME_PROFILE_ID> \
6  --provider-account-id <PROVIDER_ACCOUNT_ID> \
7  --model <PROVIDER_MODEL_ID>

JSON-file path if you want the full request shape:

deployment.json:

json
1{
2  "name": "support-bot-prod",
3  "agent_build_id": "<AGENT_BUILD_ID>",
4  "build_version_id": "<BUILD_VERSION_ID>",
5  "runtime_profile_id": "<RUNTIME_PROFILE_ID>",
6  "provider_account_id": "<PROVIDER_ACCOUNT_ID>",
7  "model": "<PROVIDER_MODEL_ID>",
8  "deployment_config": {}
9}

Then:

bash
agentclash deployment create --from-file deployment.json

6. List what you created

bash
1agentclash infra runtime-profile list
2agentclash infra provider-account list
3agentclash infra provider-account models <PROVIDER_ACCOUNT_ID>
4agentclash deployment list

At that point the workspace has a real runnable target the run-creation flow can select.

Where tools fit

Workspace tools are their own infra resource surface:

bash
1agentclash infra tool list
2agentclash infra tool create --from-file tool.json

That is separate from pack-defined composed tools. Do not mix those up in your mental model.

Verification

You should now have:

  • a workspace secret for provider credentials
  • a provider account that resolves credentials indirectly
  • a runtime profile defining execution limits
  • the exact provider model ID used by the deployment
  • a deployment that can be selected during run creation

Troubleshooting

Deployment creation fails because the build version is not deployable

The current API requires a ready build version. Mark the build version ready before deploying it.

I do not know which model to use

Start from agentclash infra provider-account models <PROVIDER_ACCOUNT_ID>. If discovery fails, use agentclash infra provider-account test <PROVIDER_ACCOUNT_ID> --model <MODEL_ID> to verify the connection and model.

I passed an API key directly and now cannot see it again

That is expected. Raw provider keys are stored as workspace secrets and the account keeps only a credential reference.

See also

PreviousWrite a Challenge PackNextInterpret Results