Connecting credentials

The credential vault

Tools that call authenticated APIs don't embed a key directly — they reference an organization-level credential by alias, written as {{secret.your_alias}} in a tool's headers or body. The real value is resolved server-side when the tool actually runs, and once saved a key is never shown again (fields display as "set," with an option to replace). Because credentials are organization-level, the same toolkit deployed for multiple agents in your org reuses the same credential automatically.

Managing credentials directly (outside a toolkit's setup flow) is done from Organization settings → Tool credentials, and both places require an admin role — see Tool credentials.

The three connection types

• Static key — paste an API key or token once; it's encrypted at rest. The simplest type, used by most REST APIs.
• OAuth2, client credentials — enter a client ID and secret, then Connect & fetch token. The platform exchanges them for an access token and refreshes it automatically — no user consent screen involved, typical of server-to-server integrations.
• OAuth2, authorization code — enter a client ID and secret, then click Connect to open a popup showing the provider's real consent screen. Once you approve, the platform keeps a refresh token and renews the access token automatically. Disconnect drops the tokens (you'll need to reconnect to use the tool again) but keeps the client ID/secret so reconnecting is quick.

Who can manage credentials

Only organization admins can save, replace, or connect credentials — if you're not an admin, saving a toolkit that needs one still works, but the tools that depend on it stay inactive until an admin finishes the connection.