> ## Documentation Index
> Fetch the complete documentation index at: https://pipedream.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agents

> Register agents you already run, so Conduit can recognize them, rotate their credentials and delegate their maintenance.

> [!WARNING]
>
> **Beta:** Agents is in beta and isn't available in every workspace. To try it,
> [contact the Pipedream team](/docs/conduit/cloud#support). Agent credentials can't obtain
> tokens or access apps and tools yet.

Adding an agent doesn't create or run one in Conduit. It gives an agent you already
operate, such as a backend service or hosted assistant, a profile in your
workspace, so Conduit knows which application is calling. The agent's code,
model and hosting stay where they are. The profile holds a client ID, credentials,
and maintainers.

Workspace admins can manage all agents; maintainers see the agents they've
been added to.

## Add an agent

1. As a workspace admin, open **Agents** and select **Create agent**.
2. Enter a name and optional description.
3. Open the agent to add credentials and, optionally, maintainers.

Agents start disabled, with no permissions.

## Credentials

An agent holds **two credentials at a time**, secrets and public keys
together, so one stays in use while you deploy its replacement. A secret is
shown once; a public key keeps its private key with you.

Create a key pair with EC P-256 (recommended) or RSA 2048+, and keep
`private.pem` in your secrets manager:

```bash theme={null}
# EC P-256 (signs with ES256)
openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -nocrypt -out private.pem
openssl ec -in private.pem -pubout -out public.pem

# Or RSA 2048 (signs with RS256)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem
openssl rsa -in private.pem -pubout -out public.pem
```

Paste `public.pem` or a JWK into **Add public key**. A pasted private key is
rejected; treat it as exposed. The key ID shown under its label is the JWK's
`kid` or the key's thumbprint.

To rotate, add a replacement, deploy it, then revoke the old credential.

## Maintainers

Admins can assign workspace members to maintain an agent: edit it, manage its
credentials and disable it. Creating, deleting, enabling and assigning
maintainers stay with admins.

Removing a maintainer leaves the agent's credentials in place; rotate any they
may have kept.

## Disable, delete and audit

Use an agent's switch to disable it. Deleting an agent removes its
credentials. The audit log records every change under **Config → Agent**.