Credentials
2 min read
Credentials is the organization's encrypted secret store. Use it for passwords, API keys, accounts, SSH keys, and two-factor codes that agents need to use.
Do not share secrets in a chat
Do not paste keys or passwords into messages to an agent. Store them as credentials to keep them encrypted, assigned, and auditable.
Create a credential
A credential contains the data an agent needs to access one service. For example, you can create one for “Production GitHub” with a username and token, or one for a server with its address, username, SSH key, and two-factor code.
Identify the access
Give it a name that explains the service and its use. Avoid generic names such as “token” or “new account”.
Add only the required fields
Combine the field types that access requires: username, password, URL, API key, SSH key, two-factor code, or note. The note is for non-sensitive instructions; secret values belong in their dedicated fields.
Assign who can use it
An assigned agent can use it while working without the secret appearing in chat. Authorized members can view or reveal fields according to their permissions, and administrators manage its configuration and assignments.
Revealing values is controlled by permissions and recorded in the organization's activity.
SSH keys and two-factor authentication
For an SSH key, the dashboard can generate an Ed25519 pair: the private key is stored encrypted and the public key can be copied to the destination system.
Two-factor fields generate the temporary code when needed. The agent can use it without publishing the underlying secret in a conversation.
Use in scheduled tasks
Script tasks can receive credentials as environment variables while they run. They are not written to the agent's disk. Each field uses its uppercase label; a two-factor field provides the current temporary code.
See Scheduled tasks to configure this automation.
Maintenance
Archived credentials can be recovered when you need them. Review credentials with no assigned agents to remove access that is no longer needed.
Permissions
Credential access is divided so viewing a record does not necessarily reveal its secret. In addition to these permissions, each credential's access list can restrict which members can reveal its values.
| Action | Permission |
|---|---|
| View the record and its assignments | credential.view |
| Create or modify a credential | credential.edit |
| Archive or delete a credential | credential.delete |
| Reveal a secret value | credential.reveal |
| Manage who can reveal the credential | credential.grant |