Credentials

Credentials is the workspace’s encrypted vault for API keys and secrets that aren’t covered by an integration: a custom SaaS token, an internal service key, anything an agent needs as an environment variable.

The model

• Store once, assign many. A credential belongs to the organization’s vault (encrypted with a tenant key that never leaves your infrastructure). Assigning it to an agent is a binding, not a copy: rotate the value once and every assigned agent picks up the new secret at its next session start.
• Automatic injection. At session start, every credential assigned to the agent is injected into its environment (the name you chose, e.g. OPENAI_API_KEY). Tools and skills just read the env var.
• Value secrecy. Values are write-only: the UI shows the name and metadata, never the secret. Rotating replaces the value in place.

Audit

Create, read and rotation events are logged; you can see which agent run used a credential and when.

Tip

For OAuth-backed services (post with X, read Notion), prefer Integrations; they handle token refresh. Credentials are for raw keys.