Know which credential unlocks which MARS capability.

Credential Map

Start with the capability you want, then choose the narrowest credential path. Do not reuse a token just because it happens to work for another surface.

GitHub Release Access

mars auth github check first makes one exact, no-redirect anonymous request to the official api.github.com release-metadata endpoint. Only an exact 401, 403, or 404 may resolve optional credentials and retry the same origin and path once. The result is classified as anonymous, authenticated, or unavailable without disclosure. Credential availability does not authorize publication or prove artifact authenticity. Source signing and publication stay blocked until the approved F-018 cutover workflow; this credential path is separate from target model or board integration credentials.

mars auth github check --json

gh auth login
mars auth github setup
mars auth github check --json

mars auth github setup --token "$GH_TOKEN"

mars auth github setup --config /private/tmp/mars-config.yaml
mars auth github check --config /private/tmp/mars-config.yaml --json
mars auth github clear-local --config /private/tmp/mars-config.yaml

Model Credentials

Cloud and hosted model routes use an api_key_env name. MARS resolves the actual key from the process environment or from ignored .harness/.env.local. Serializable routing data keeps provider, model, endpoint, and env-var name; it does not carry the API key value.

export ANTHROPIC_API_KEY=...
mars models evaluate \
  --provider anthropic \
  --model claude-sonnet-family \
  --api-key-env ANTHROPIC_API_KEY

export ANTHROPIC_API_KEY=...
mars models credentials write-local-env \
  --repo ~/my-project \
  --api-key-env ANTHROPIC_API_KEY \
  --yes \
  --json

mars models override \
  --repo ~/my-project \
  --role engineer \
  --provider openai \
  --model gpt-4.1 \
  --api-key-env OPENAI_API_KEY

Provider Env Vars

Provider names and default env vars come from the model provider catalog. OpenAI-compatible endpoints can use a user-supplied env var name because the endpoint is operator-defined.

Integration Secrets

Optional code-host, JIRA, and Atlassian MCP integrations use environment-variable indirection. Config can name the variable that contains a webhook secret, base URL, API token, or provider credential, but repo-owned config must not contain the value. Keeping credentials out of repo-owned config does not keep either authentication or integration data on-device during use. The selected service receives authentication material according to its protocol, and configured services receive the scoped repository, work-item, tool, and request data needed to perform each operation.

Files And Storage

Secret-safe operation depends on knowing which files are repo-owned contracts and which files are machine-local state.

Safe Output

Treat terminal output, JSON, traces, tickets, docs, screenshots, and chat as potentially durable. MARS commands aim to print remediation and env-var names rather than secret values, but users still need to avoid leaking shell-expanded values.

export OPENAI_API_KEY=<secret>
mars models credentials write-local-env --repo . --api-key-env OPENAI_API_KEY --yes

mars guardrails secret-scan --repo .
mars guardrails secret-scan --repo . --staged --json

mars guardrails install-hooks --repo .
git status --short

Verification

Verify credentials by the capability they unlock, not by printing the credential. Prefer JSON when another agent or script needs to decide the next action.

Recipes

make install
mars setup
mars doctor

gh auth login
mars auth github setup
mars auth github check --json

export OPENAI_API_KEY=<secret>
mars models credentials write-local-env \
  --repo ~/my-project \
  --api-key-env OPENAI_API_KEY \
  --yes \
  --json
git -C ~/my-project status --short

mars guardrails secret-scan --repo ~/my-project --json
git -C ~/my-project status --short

Troubleshooting

For setup failures, use the Install And Setup Reference. For model routing, use the Models And Inference Guide. For secret scanning and trust controls, use the Safety, Trust, And Quality Guide.