Credentials

Before enabling a live source

Install credentials in the same shell or process environment from which the agent or frontier command starts. Exporting a variable in one terminal does not inject it into an already-running desktop app or another shell. Do not put secret values in frontier.yaml, an Agent Skill prompt, a committed .env, a run artifact, or a chat message. Keep a local secret file outside the repository if your environment requires one, restrict its permissions, and load it into the process before launching the agent.

Set enabled: true and mode: live in YAML only after the corresponding target and authentication are ready. api_key_env, token_env, username_env, and password_env are variable names; they are not places to paste values. An offline fixture needs no live credential.

alphaXiv MCP

For this harness's non-interactive MCP client, create an API key in alphaXiv Settings → API Keys. The client sends it as a Bearer token to https://api.alphaxiv.org/mcp/v1. The alphaXiv website's browser sign-in or an agent's separately configured OAuth MCP connection does not automatically authenticate the Python harness. See the official MCP documentation.

# In the shell that launches the agent or frontier command:
read -r -s -p "alphaXiv API key: " ALPHAXIV_API_KEY
printf '\n'
export ALPHAXIV_API_KEY

sources:
  alphaxiv:
    enabled: true
    mode: live
    api_key_env: ALPHAXIV_API_KEY
profile:
  topics:
    - id: agent-harness
      description: agent execution harnesses
      search:
        providers: [alphaxiv]
        query: Papers on execution and evaluation harnesses for AI agents
        keywords: [agent harness, coding agents, evaluation]
        alphaxiv_difficulty: 5

The Skill's page-level PDF evidence call also needs this key even when Discovery used another provider. In a development checkout install the optional dependency with uv sync --locked --extra alphaxiv; the Setup Skill installs the MCP dependency for a packaged tool when this source is requested. A missing or invalid key makes the live call fail; the adapter does not silently fall back to anonymous search.

OpenAlex

Basic OpenAlex queries can run without a key. For a higher free daily budget, create an account and copy the key from OpenAlex Settings → API. The harness sends the value as an Authorization: Bearer header when the named environment variable is present; it does not use a key automatically if api_key_env is omitted. See OpenAlex authentication.

read -r -s -p "OpenAlex API key: " OPENALEX_API_KEY
printf '\n'
export OPENALEX_API_KEY

sources:
  openalex: {enabled: true, mode: live, api_key_env: OPENALEX_API_KEY}

Remove api_key_env if you intentionally use keyless basic access. Topic search also requires profile.topics[].search.providers: [openalex]; a key alone does not define a search.

OpenReview API 2

The current adapter uses the official openreview-py API 2 client. It accepts either a valid existing OpenReview session token in OPENREVIEW_TOKEN or a registered OpenReview username and password in OPENREVIEW_USERNAME and OPENREVIEW_PASSWORD. A token, when present, takes precedence. OpenReview's documented setup is username/password; you do not need to obtain a separate generic API key for this workflow. If you do not have an account, create an OpenReview profile. See their API 2 client instructions.

read -r -p "OpenReview username: " OPENREVIEW_USERNAME
read -r -s -p "OpenReview password: " OPENREVIEW_PASSWORD
printf '\n'
export OPENREVIEW_USERNAME OPENREVIEW_PASSWORD

If you already have a valid API 2 session token, use this instead of the username/password pair:

read -r -s -p "OpenReview session token: " OPENREVIEW_TOKEN
printf '\n'
export OPENREVIEW_TOKEN

tracking:
  venues:
    - provider: openreview
      venue_id: ICLR.cc/2026/Conference
sources:
  openreview: {enabled: true, mode: live}

The YAML fields username_env, password_env, and token_env let you rename these variables. A session token can expire; username/password sign-in is the documented client path if you do not already have one. Live mode also needs at least one venue target to fetch submissions; check that the exact venue group and submission invitation exist in API 2. A password or token may be sensitive enough to access private account material; do not share either with the agent in chat.

Semantic Scholar, arXiv, and local files

Semantic Scholar's current adapter fetches papers for a stable author ID and can run without a key at public limits. To request a private key, use the Semantic Scholar API key form; their Academic Graph API expects an x-api-key header. Set a variable such as SEMANTIC_SCHOLAR_API_KEY and name it in sources.semantic_scholar.api_key_env. You must also configure tracking.scholars[].identities.semantic_scholar; this adapter does not perform general topic search.

read -r -s -p "Semantic Scholar API key: " SEMANTIC_SCHOLAR_API_KEY
printf '\n'
export SEMANTIC_SCHOLAR_API_KEY

sources:
  semantic_scholar:
    enabled: true
    mode: live
    api_key_env: SEMANTIC_SCHOLAR_API_KEY

The current arXiv Atom API and local library adapters do not require keys. arXiv requires paper_ids, queries, or categories; local library requires at least one existing root directory. OpenReview and Semantic Scholar may return errors or throttling even with valid credentials; inspect the source error rather than replacing it with a fabricated empty result.

Check without printing secrets

Use a presence check that does not echo the value: test -n "${ALPHAXIV_API_KEY:-}" && echo set. If a key is missing in the agent process, restart that process from the shell where you exported it. To rotate a compromised key, revoke it at the provider, update the process environment, and rerun Sync. Provider secrets are never needed in a public Discovery HTML page.