user

A user is a catalog resource that represents your developer identity in the catalog. It stores your git configuration, SSH public keys, and references to your encrypted secrets. When you spawn an agent, the platform reads your user record to assemble the credentials the agent needs. User records are self-owned. Only the authenticated developer matching the resource’s name can read or write the record. murmur setup creates it automatically when you upload your developer profile.

Fields

Name	Type	Required	Description
`name`	string	yes	Canonical name: `{provider}/{username}` (e.g. `github_oauth/alice`).
`git_name`	string	no	Git author name for commits (e.g. `Alice Developer`). Gathered from `git config user.name` during `murmur setup`.
`git_email`	string	no	Git author email (e.g. `alice@example.com`). Gathered from `git config user.email` during `murmur setup`.
`ssh_public_keys`	string[]	no	SSH public keys for `murmur ssh` access. Each entry is a full `authorized_keys` line (e.g. `ssh-ed25519 AAAAC3... alice@laptop`).
`github_token_secret`	string	no	Name of the user-secret containing your GitHub OAuth token.
`claude_token_secret`	string	no	Name of the user-secret containing your Claude subscription OAuth token. Preferred over `anthropic_api_key_secret` at spawn time.
`claude_refresh_token_secret`	string	no	Name of the user-secret containing your Claude OAuth refresh token. Set alongside `claude_token_secret`.
`anthropic_api_key_secret`	string	no	Name of the user-secret containing your Anthropic API key. A fallback used only when no Claude OAuth credential is active.
`openai_api_key_secret`	string	no	Name of the user-secret containing your OpenAI/Codex API key. A fallback used only when no OpenAI OAuth credential is set.
`signing_key_secret`	string	no	Name of the user-secret containing your Ed25519 commit signing key (PEM).
`claude_oauth_credentials`	object[]	no	Additional labeled Claude OAuth credentials. Each entry has `token_secret`, `refresh_token_secret`, and `label`. Spawns round-robin across the legacy pair (entry 0, label `default`) plus these entries.
`openai_oauth_token_secret`	string	no	Name of the user-secret containing your OpenAI (ChatGPT) subscription OAuth access token. Preferred over `openai_api_key_secret`.
`openai_oauth_refresh_token_secret`	string	no	Name of the user-secret containing your OpenAI OAuth refresh token.
`openai_oauth_id_token_secret`	string	no	Name of the user-secret containing your OpenAI OAuth id_token. Codex needs it to establish the ChatGPT account.
`openai_oauth_credentials`	object[]	no	Additional labeled OpenAI OAuth credentials. Each entry has `token_secret`, `refresh_token_secret`, `id_token_secret`, and `label`.
`secret_mounts`	object[]	no	User-secrets delivered to every VM you spawn. Each entry has `name` (the secret’s leaf name), `mount_type` (`MOUNT_TYPE_ENV` or `MOUNT_TYPE_FILE`), and `env_name`, `path`, or `mode`. Manage it with `murmur secret mount`, `murmur secret unmount`, and `murmur secret mounts`.
`user_system_prompt`	object	no	Personal instructions appended to every turn of agents you spawn without a service profile. Set `user_system_prompt.text` to Markdown, maximum 16 KiB. Empty disables it.
`deny_platform_inference_fallback`	bool	no	When `true`, agents you spawn without a service profile are refused Macroscope-supplied inference for any provider you have no credential for. Default `false`: those agents run on a Macroscope-supplied key billed to the tenant.
`inference_connections`	object[]	no	Inference connections you can run opencode agents against, in the order added. Each entry names one of your own user-secrets in `api_key_secret`; connection ids are unique.
`keyboard_shortcut_overrides`	map	no	Per-action dashboard keyboard shortcut overrides, keyed by action ID. Only values that differ from the defaults are stored.
`github_role`	string	no	GitHub role (catalog kind `github-role`) controlling what agents may do with your selected GitHub credential. Empty selects the platform coding-agent role.
`updated_at`	timestamp	no (read-only)	Timestamp of last update. Set automatically.

The *_secret fields are references to user-secret resources, not raw credential values. Each reference names a user-secret resource in the format {provider}/{username}/{SECRET_NAME} (e.g. github_oauth/alice/GH_TOKEN). murmur setup creates these user-secret resources and wires the references automatically.

Examples

Viewing your user record

murmur get user github_oauth/alice

Creating a user record via `murmur setup`

murmur setup creates your user record and its associated user-secret resources in one step. You do not need to create the user record manually.

murmur setup

Setting a user record manually

cat <<'EOF' | murmur set user github_oauth/alice
name: github_oauth/alice
git_name: Alice Developer
git_email: alice@example.com
ssh_public_keys:
  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... alice@laptop"
github_token_secret: github_oauth/alice/GH_TOKEN
claude_token_secret: github_oauth/alice/CLAUDE_TOKEN
claude_refresh_token_secret: github_oauth/alice/CLAUDE_REFRESH_TOKEN
signing_key_secret: github_oauth/alice/SIGNING_KEY
EOF

Setting a user record manually requires that the referenced user-secret resources already exist. Use murmur setup to create both in the correct order.

Errors

Code	Meaning	What to do
`INVALID_ARGUMENT`	`name is required`	Provide the `name` field in `{provider}/{username}` format.
`INVALID_ARGUMENT`	`github_token_secret: secret "..." is not owned by "github_oauth/alice" — a user may only reference secrets under its own "github_oauth/alice/" prefix`	Reference only user-secrets under your own `{provider}/{username}/` prefix.
`INVALID_ARGUMENT`	`github_token_secret: secret "..." does not exist`	Create the user-secret first with `murmur secret set --user`.
`INVALID_ARGUMENT`	`user_system_prompt.text exceeds 16384 bytes`	Shorten the prompt.
`PERMISSION_DENIED`	Caller does not match the resource name	You can only read or write your own user record. The `name` must match your authenticated identity.

Profiles and secrets: concept overview of developer credentials and encryption
murmur setup: CLI command that creates your user record and secrets
user-secret: the per-user secrets the *_secret fields reference
secret: tenant-wide secrets (distinct from per-user secrets)
murmur set: CLI command for creating and updating catalog resources
murmur get: CLI command for reading catalog resources
murmur spawn: spawning agents that consume the user record

Getting Started

Core Concepts

Guides

Fields

Examples

Viewing your user record

Creating a user record via `murmur setup`

Setting a user record manually

Errors

​Fields

​Examples

​Viewing your user record

​Creating a user record via murmur setup

​Setting a user record manually

​Errors

​Related

Fields

Examples

Viewing your user record

Creating a user record via `murmur setup`

Setting a user record manually

Errors

Related