BYOA credentials
Workspace vs host vs env credential scopes for MCP apps.
BYOA (bring your own app) means storing OAuth client id/secret, Snowflake PAT, or HTTP MCP URLs in Brain instead of only process env.
Resolve order
When Agent mode needs credentials, Brain checks in order:
- Workspace —
.eve/workspaces/{id}/…(This workspace) - Host (stored) —
.eve/mcp-app-credentials-…(Entire host) - Environment —
SLACK_MCP_CLIENT_ID,GITHUB_MCP_*,SNOWFLAKE_*, …
DCR apps (ClickUp, Notion, …) still register dynamically and usually skip static client secrets.
Who can Set up
| Scope | Who | Where |
|---|---|---|
| This workspace | Workspace owner/admin | /tools → Set up → This workspace |
| Entire host | Instance admin | /tools → Set up → Entire host |
| Env | Operators | Process env / Dokku config |
The setup dialog shows This workspace / Entire host when you can manage both. Remove saved clears only the selected scope.
License gate
The BYOA entitlement gates workspace-scoped credential saves. Host-scoped Set up and env fallbacks are not blocked by that chip. Unlicensed self-host defaults allow workspace BYOA.
Error when blocked: This license does not allow workspace BYOA credentials.
Tips
- Prefer workspace credentials for team isolation; use host/env for a single shared Slack/GitHub app
- Persist
.eve/across deploys or users reconnect / lose BYOA files - Members without configure rights see that a workspace admin must set the app up first