# Import Secrets

URL: https://docs.usestitch.ai/docs/resources/secrets/import



Use the CLI to import Claude subscription tokens or saved ChatGPT credentials.
For other credentials, use
[Managing Secrets](/docs/resources/secrets/managing) to add them through the UI or CLI.

## Claude Subscription Token [#claude-subscription-token]

You need Claude Code installed and access to a Claude subscription.
In a private terminal, run:

```sh
stitch secrets import claude --name CLAUDE_SUBSCRIPTION
```

## ChatGPT Credentials [#chatgpt-credentials]

Sign in with the native client first, then upload its existing login in a private terminal:

```sh
stitch secrets import codex --name WORK_CHATGPT
stitch secrets import codex --name WORK_CHATGPT --file ./auth.json
```

The default source is `CODEX_HOME/auth.json`, or `~/.codex/auth.json` when
`CODEX_HOME` is unset. Keyring-only logins require a file-backed credential source.
Stitch does not install Codex, start login, or print tokens.

For OpenCode V2, import a saved OpenAI OAuth account:

```sh
stitch secrets import opencode --name WORK_CHATGPT
stitch secrets import opencode --name WORK_CHATGPT --account CREDENTIAL_ID
```

When several OpenAI OAuth accounts exist, the command asks you to select one.
Use `--account` with the credential ID for non-interactive selection. The native
`opencode auth list` command shows account metadata. Stitch uses the supported
credential API, which may start the local OpenCode service; it does not edit SQLite.

OpenCode V1 users can pass their native `auth.json` explicitly:

```sh
stitch secrets import opencode --name WORK_CHATGPT --file ./auth.json
```

Only OpenAI OAuth credentials are accepted by this importer, not API keys or other
providers. Both import commands store the same normalized ChatGPT payload and
preserve native ID tokens when available. They validate the format, not account
entitlements. Expired access tokens can be imported when a refresh token is present.

<Callout>
  These commands prepare secrets for the planned subscription runtime adapters. Importing a secret
  does not yet enable ChatGPT subscription auth on a harness.
</Callout>

Imports create a new secret by default. To renew a secret you own, add `--replace`:

```sh
stitch secrets import codex --name WORK_CHATGPT --replace
```

Replacement preserves the secret ID and name, so existing references remain valid.

<Callout type="warning">
  Tokens are never printed in Stitch output. Imported credentials belong to the active organization
  and must be treated like passwords. Do not share or commit the source files.
</Callout>