Connect services safely

Many useful outcomes require access to another service: a test payment account, an email provider, a database, an analytics API, or a private repository. Add that access through Podbay instead of pasting a secret into a Claude conversation.

The normal handoff

1. Ask Claude for the result you want.
2. If a credential is missing, Claude records what it needs and why.
3. Open the pod's Secrets panel from the request or dashboard.
4. Add the value there.
5. Tell Claude to continue. It can load the new value without you revealing it in chat.

Only the pod owner can add or change secrets. Claude can see which expected credentials are present and use their values inside the project, but it cannot grant itself new access.

Choose the narrowest useful access

Prefer a project-specific credential, test account, restricted token, or read-only key when that is enough. Avoid giving a development pod an organization-wide administrator credential merely because it is convenient.

Before adding access, ask:

• Which exact outcome requires it?
• Can the provider limit it to this project or environment?
• Does Claude need read access, write access, or both?
• Will an action outside the pod still require my approval?

Keep credentials out of durable project files

• Do not paste secrets into Claude, the browser terminal, an issue, or a pull request.
• Do not commit .env files or credentials to Git.
• Ask Claude not to print secret values while diagnosing access.
• Rotate a credential if it appears in logs, command output, chat, or version history.
• Remove unused access at the external provider as well as in Podbay.