AI connections & credentials

Open Connect AI in the creator and select an available route. Your EoC plan, a provider subscription and a provider API balance are separate things. The connection interface shows the route and setup available to your account.

Personal API connections

Quick connection keeps your API key for the current tab without a vault password. A saved connection uses an encrypted local vault. Use provider sign-in where offered, or enter a key obtained from that provider's own account settings. Do not paste an account password as an API key.

Connecting does not itself start a build or establish that the provider will accept a request. Select the connection/model, check your provider access and usage limits, and review Build options before sending. The provider's limits and billing apply.

Native subscriptions and included AI

Claude/Codex subscription workflows use supported official clients and their own sign-in steps. A locally paired Companion and a hosted project terminal are distinct execution environments. Follow the displayed setup for the route you select; a browser API key does not automatically configure either one.

Public signed Companion installers remain pending as of this guide's review date. Check Downloads for actual availability. Do not assume an installer exists because a connection option is visible.

Some eligible accounts have a bounded included-AI allowance. Availability, funding and model policy are shown for that account. It is not universal unlimited AI, and the creator does not silently fall back to your personal key when an allowance is exhausted.

Where credentials and context go

The saved personal vault is encrypted in this browser and separated by signed-in account. EoC cannot recover its password. Lock it on shared computers and keep any encrypted backup and password safely outside browser storage.

For supported API requests, EoC's relay temporarily receives the credential to contact your selected provider. That provider receives the task and relevant context and applies its own policies. Local project records, optional account backups and hosted workspace data have separate storage behavior; see privacy and security.

A failed or interrupted call can still cost money. Recovery preserves known usage and marks unresolved charges as unknown. It does not automatically refund or replay the request.

Keep secrets out of a game

Browser source and published assets are visible to users. Never include API keys, wallet secrets or passwords in prompts, files, images or public repositories. A private server environment file is plain text configuration, not encryption.

.env
.env.*
!.env.example

Commit only an example containing variable names and empty values. Public build variables such as NEXT_PUBLIC_ and VITE_ can be bundled into the website; they are unsuitable for secrets. A game that needs a private API should call a server you control.

If a key leaks, revoke it at the provider, inspect usage and replace it. Deleting the visible text does not revoke the key. For project recovery without credentials, see projects and recovery.