Factory credentials
Factory keeps two kinds of secrets on the agent's behalf, both held by Factory's backend — they are never exposed to the browser and never baked into sandbox images.
Agent credentials
Agent credentials authenticate the agent runtime itself — model provider keys and similar. Each credential has a name and a provider; the Factory settings page lists them with their creation time so you can audit what a sandbox can reach.
Source credentials
Source credentials authenticate against external git hosts for repos that mirror an upstream (for example a GitHub or Assembla origin). When a project has a source link, sessions use the matching source credential to sync with the upstream — pulls and pushes to the mirror happen on Factory's backend, not in your browser.
Provisioning
Factory provisions credentials automatically. The Spaces UI lists them read-only today; adding or rotating a credential isn't self-serve yet, and the settings pages say so instead of offering an action that can't complete. On some deployments, credential management isn't available at all — the page will say so rather than failing silently.
Scoping
A session only ever receives the credentials its project needs: the agent credential for its runtime and, if the repo mirrors an upstream, that repo's source credential. Sandboxes are torn down when the session ends; nothing persists in the image.