# Pi auth on sandboxes

How pi gets LLM creds and a model when it runs on a sandbox — the detached path ([daytona runtime](../sandboxes/sandbox-daytona.md)) and manual `arbe x`. In-process bot dispatch does not run pi on the sandbox; it replies via pi-ai with OpenRouter by default ([pi](../chat/pi.md)) and reaches the sandbox only through the `run_command` tool. Decisions, not mechanics — wire-up lives in [environments](../sandboxes/environments.md), [secrets](secrets.md).

## Decisions

1. **Creds live in `arbe secret`.** Environments bind names; values forward as `set -lx` env vars into the per-turn `fish -lc`. Env-var keys only — OAuth (Anthropic Pro, OpenAI Codex, …) is v2.
2. **OpenRouter is the canonical sandbox credential.** Store and bind `OPENROUTER_API_KEY`; pi receives it as an env var, no persistent pi login on the sandbox. Provider-specific keys (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, …) work when paired with an explicit model. Default model is `DEFAULT_BOT_MODEL` (`packages/core/schemas/agent-model.ts`) — a pinned cheap OpenRouter ref, not `openrouter/auto`. See [llm-keys](llm-keys.md).
3. **Setup is two commands.** `arbe secret set`, then `arbe env create --secret`; Daytona boxes need no per-box setup — see "Typical setup workflow" in [runtime](../sandboxes/runtime.md).

## Failure narration

Pi auth/billing/quota errors are hoisted into a `signal.thread.pi_failed` entry alongside the `failed` status flip. Carries `errorClass` (`auth` / `billing` / `quota` / `network` / `pi_exit` / `unknown`), a short `message`, and provider/model when known. Additive — the `pi.assistant` payload is unchanged. Source: `decidePiOutcome` (`packages/sandbox/src/daytona/decide-pi-outcome.ts`) + `classifyProviderError` (`packages/sandbox/src/provider-error.ts`).

## Open

- CLI's `~/.config/arbe/sandboxes/<name>.env` overlaps with `arbe secret`; not yet retired.
- OAuth providers — needs caller-managed credential storage and per-sandbox refresh.

## See also

[dispatch](../chat/dispatch.md) · [environments](../sandboxes/environments.md) · [secrets](secrets.md) · [pi](../chat/pi.md)