---
title: "Sandbox & credentials"
description: "Keychain gaps, Amp/orbs, and .env-based remote access."
---

> Documentation Index
> Fetch the complete documentation index at: https://machine-memory.jfa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox & credentials

Sandboxes (Amp orbs, CI, locked-down Linux) often cannot use the OS keychain. MCP and CLI credentials are different paths.

## MCP vs CLI credentials

| Path               | Auth                                                         | Sandbox notes                                                                                            |
| ------------------ | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- |
| **MCP** `/mcp`     | GitHub OAuth 2.1 in the browser, or a code entered at `/activate` | No `MACHINE_MEMORY_DB_TOKEN`. Cookie signing uses `MACHINE_MEMORY_COOKIE_ENCRYPTION_KEY` on the Worker. |
| **CLI** `--remote` | Worker URL + bearer token                                    | Needs keychain **or** repo-root `.env` (below).                                                          |

MCP clients never read your local keychain or `.env` token. If OAuth fails, see [MCP troubleshooting](/troubleshooting/mcp).

## CLI remote without keychain

When Bun Secrets / libsecret / macOS keychain is unavailable, put credentials in a **repository root** `.env` and run commands from that root:

```dotenv
MACHINE_MEMORY_DB_URL=https://your-worker.example
MACHINE_MEMORY_DB_TOKEN=your-worker-token
```

- URL may be the Worker origin or `…/query`; the CLI normalizes to `/query`.
- Keep `.env` out of version control.
- Full notes: [Sandboxed keychain access](/human/remote/keychain-access).

If the keychain is unreachable, the CLI suggests `.env` instead of forcing `remote setup` / `provision`.

## Amp orbs and project secrets

- Inject `MACHINE_MEMORY_DB_URL` and `MACHINE_MEMORY_DB_TOKEN` (and Cloudflare deploy secrets if you deploy from the orb) as **project/workspace secrets**, not only a laptop keychain.
- After changing secrets, restart orb processes so children see the new env (`amp orb restart-processes` when applicable).
- Trim whitespace on `CLOUDFLARE_ACCOUNT_ID` / tokens; a trailing space makes Wrangler reject the account id as invalid.

## MCP-only in a sandbox

1. Worker already [provisioned](/infrastructure/overview) and [MCP enabled](/docs/mcp/enable) from a machine that can deploy.
2. In the sandbox, connect the MCP client to `https://<worker-url>/mcp`. A browser on that machine can finish OAuth directly. Clients implementing Machine Memory's headless protocol can print a code for approval at `https://<worker-url>/activate`, then retrieve the authorization code by polling. No loopback listener is needed. This is not automatic support in existing MCP clients; see [Headless login](/docs/mcp/headless).
3. Install agent instructions without the CLI:

```sh
   curl -fsSL https://machine-memory.jfa.dev/init-mcp | bash
```

   See [MCP init](/docs/mcp/init).

## Interactive token prompts

`Bun.prompt` echoes input and cannot mask secrets. The CLI’s interactive Worker token prompt uses a raw TTY reader (`*` per character). Prefer `--token` / env / `.env` in automation so nothing interactive runs.

Source: https://machine-memory.jfa.dev/troubleshooting/sandbox/index.mdx