Open Settings > Agent in OpenHands 1.20.0, edit a profile, and you can now choose exactly which saved secrets that profile is allowed to access — all of them, none of them, or a hand-picked list of names. That secrets scoping is the centrepiece of openhands agent profiles as of the v1.20.0 release on 17 September 2026, and it lands alongside two related upgrades: automations can now run under a saved profile you select during setup, and Canvas can forward Docker conversation runtime settings to its bundled Agent Server. Together they turn profiles from a convenience into the permission layer for every automation you run.
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside · Want AI SEO help 1-on-1? Book a free SEO strategy session →
All of the release detail below comes from the official OpenHands v1.20.0 release notes, published on the project's GitHub repository on 17 September 2026. OpenHands itself is an open-source software-engineering agent released under the MIT licence, installable via npm, Docker or from source, with the repository showing around 88.5 thousand GitHub stars — so these are changes to a tool you can self-host for free, paying only for the model inference behind it.
What OpenHands Agent Profiles Actually Do
A profile in OpenHands is a saved agent configuration you can reuse: the settings a given agent runs with, kept under a name so you do not rebuild the setup every time. Before 1.20.0, the sore point was credentials. Saved secrets — API keys, tokens, service passwords — were effectively ambient: available to agents without a per-profile way to fence them off. If you ran one agent for public repository work and another that touched production services, both sat closer to your full credential set than any security-minded operator would like.
Version 1.20.0 changes that. From the profile editor under Settings > Agent, each profile now carries its own secrets policy with three modes:
- All secrets — the profile behaves as before, with access to everything you have saved. Fine for a trusted, do-everything local agent.
- No secrets — the profile runs credential-blind. Ideal for experiments, untrusted task inputs, or agents whose job never requires authentication.
- Selected names — the profile sees only the secrets you explicitly tick. This is the mode that makes least-privilege practical: your deploy profile gets the deploy token and nothing else.
One thoughtful detail from the release notes: if a secret referenced by a profile is deleted, the reference is preserved rather than silently removed. That sounds minor until you rotate credentials — the profile keeps pointing at the name, so re-adding a secret under the same name restores the wiring instead of leaving you hunting for which profile quietly lost access.
Automations Now Run Under Saved Profiles
The second half of the openhands agent profiles story in 1.20.0 is scheduling. When you set up or edit an automation — a job that runs without you at the keyboard — you can now select which saved agent profile it runs under, provided the backend supports agent profiles. That closes the loop with secrets scoping: an unattended job is precisely the situation where you want the narrowest possible credential set, and now the automation inherits whatever fence its profile defines.
The practical pattern looks like this. Build one profile per job family — a nightly dependency-update profile with repository access only, a reporting profile that can read analytics keys but never write anywhere, a deploy profile with a single scoped token. Then point each automation at its matching profile. If a scheduled job goes wrong at 3am, the blast radius is whatever that one profile could reach, not your whole credential store. This is the same least-privilege thinking that mature teams apply to CI pipelines, arriving in an open-source agent you can run on your own machine — and it is a big part of why agent frameworks are converging on profile-based permissioning, a trend you can see across the best AI agent frameworks right now.
If you want automations that run unattended and make money while you sleep — with the guardrails set up properly — the AI Profit Boardroom hands you 1,000+ done-for-you agent workflows plus weekly live coaching to deploy them → join the AI Profit Boardroom. Want a 1-on-1 audit of your automation stack first? Book a free SEO strategy session.
Docker Runtime Forwarding: The Third Piece
The remaining user-facing change in 1.20.0 is aimed at local Canvas deployments. Canvas now forwards six conversation-runtime settings to its bundled Agent Server when the operator explicitly sets them: runtime, image, memory, CPU, PID limits and startup timeout. In plain terms, if you run OpenHands conversations inside Docker by setting OH_CONVERSATION_RUNTIME=docker, the resource limits you configure actually reach the container that does the work, instead of applying only to the outer layer.
For automation builders this matters more than it first appears. Profiles decide what an agent can access; runtime forwarding decides what it can consume. Between the two, a 1.20.0 setup lets you cap an unattended agent's credentials and its CPU, memory and process count — which is the difference between an automation platform you can leave running overnight and one you babysit. The forwarding only applies when you explicitly set the values, so existing deployments keep their current behaviour until you opt in.
Setting Up A Least-Privilege Profile: A Worked Order
The release notes describe the controls; here is a sensible order to apply them in for any new automation, using only what 1.20.0 provides:
- Name the job, not the agent. Create a profile per job family — nightly-updates, weekly-report, deploy — so the profile's purpose is obvious six months from now.
- Start from no secrets. Set the profile's secrets mode to none, run the job once, and see what actually fails. That failure list is your real credential requirement.
- Switch to selected names. Tick only the secrets the dry run proved necessary. Resist adding one more for convenience — convenience is how every over-permissioned system got that way.
- Attach the profile to the automation. Select the saved profile during automation setup or editing, so the schedule and the permissions travel together.
- Cap the runtime if you are on Docker. Set the conversation-runtime limits explicitly so Canvas forwards memory, CPU and PID caps to the Agent Server.
If you are newer to this whole space and the vocabulary is running ahead of you, the how to build an AI agent guide covers the foundations that profiles sit on top of, and the no-code vs code AI agents comparison will tell you whether a tool like OpenHands is even the right altitude for your first build.
How This Compares Across The Agent Landscape
Per-profile credential scoping is becoming the table-stakes feature for agents that run real work. The pattern of syncing and scoping configuration across environments shows up in Claude Code too — the skills and plugins sync to the Claude Code terminal covers that side — and coding-agent alternatives like the one in the Orca ADE tutorial are competing on the same operational maturity, not just raw model quality. For the Hermes side of the fence, the Hermes agent use cases guide shows what people actually run unattended, which is exactly the workload profile scoping exists to protect.
Model choice still matters, of course — an automation is only as good as the brain driving it. The Goldie Bench write-up tracks how the leading agent models compare in hands-on tests, so pair whichever ranks well for coding with a tightly scoped profile and you have both halves of a trustworthy automation. And if you want the full operating layer around it — mission control, memory and orchestration rather than one-off scripts — that is the territory the Agent OS guide maps out.
OpenHands Agent Profiles FAQs
What are agent profiles in OpenHands?
They are saved agent configurations you manage under Settings > Agent. As of v1.20.0, released 17 September 2026, each profile can scope which saved secrets it accesses — all, none, or selected names — and automations can be assigned a saved profile to run under.
Can an OpenHands profile see all my API keys?
Only if you set it that way. The 1.20.0 profile editor offers three modes: all secrets, no secrets, or a selected list of secret names. For unattended automations, the selected-names mode is the sensible default, granting each job only the credentials it demonstrably needs.
What happens if I delete a secret a profile uses?
Per the release notes, deleted secret references are preserved rather than silently removed. The profile keeps the reference by name, so restoring a secret under the same name puts the profile back in working order without reconfiguration.
Is OpenHands free to use?
The software is open source under the MIT licence and free to self-host via npm, Docker or source. Your running costs are the model inference for whichever LLM you connect, plus optional paid hosted infrastructure if you choose OpenHands Cloud instead of self-hosting.
Do I need Docker for the new runtime settings?
The runtime forwarding applies to local Canvas deployments using Docker conversation runtimes — set OH_CONVERSATION_RUNTIME=docker and explicitly configure the six forwarded settings: runtime, image, memory, CPU, PID limits and startup timeout. If you do not set them, existing behaviour is unchanged.
Verdict: The Permission Layer Automations Needed
OpenHands 1.20.0 is not a flashy release, and that is rather the point. Secrets scoping per profile, automations bound to saved profiles, and runtime limits that actually reach the container — these are the unglamorous controls that decide whether you can trust an agent with scheduled, unattended work. If you run OpenHands automations today, the upgrade path is obvious: update, rebuild each automation around a least-privilege profile, and cap the runtime. Twenty minutes of configuration now is what makes the 3am job boring — and boring is exactly what you want from an automation.
If you want a business where scoped, unattended agents do the repetitive work while you focus on growth, the AI Profit Boardroom gives you the workflows, prompt libraries and five live coaching calls a week to build it → get inside the AI Profit Boardroom. Prefer to talk it through 1-on-1 first? Book a free SEO strategy session.
