Core Concepts
Credential Types
Credentials are stored in the Credentials module, which acts as a secure vault for API keys, tokens and other authentication details. Agents, workflows and tools use these credentials to connect to external services.
Expires On (optional). For OAuth credentials, this is filled in automatically if the provider returns an expiry date; otherwise you can enter it. For key-based credentials, you can set it yourself.
Where credentials are used. Personal and Shared credentials can both be used by Agents, Workflows, EGPT, Knowledge Gardens, the Data Library and the prebuilt tools in the Tools Directory. See Using Credentials in Assets for which credentials appear where.
Existing credentials. Credentials created in Tools → Accounts before this release are moved to the new model automatically, with no action required. An informational banner, Accounts are now Credentials, is shown for two weeks after the change.
- Private credentials become Personal credentials, with the original creator as owner.
- Public credentials become Shared credentials, with their workspace scope preserved.
- Credential IDs are preserved, so existing agent, workflow and EGPT references keep working without relinking.
- OAuth credentials are reclassified, and their tokens remain valid after migration.
- Public credentials created by end users without the required policy are reassigned to a new owner.
Usage Rules
- Personal credentials are visible only to their owner. Nobody else, including Admins, can view them.
- Shared credentials are visible only to users in the mapped workspaces.
- Sensitive data, such as tokens and key fields, is always masked, whatever your policy.
- Any policy can use a Shared credential in assets where the credential's workspace is mapped.
Permissions by Policy
GenAI Consumer users can work fully with their own Personal credentials but can only use Shared ones. Higher roles can also create and manage Shared credentials. In the tables below, Higher roles means Workspace Admin, Tenant Admin, GenAI User, GenAI Controller, GenAI Partner User and GenAI Creator (No Workflow).
Personal credentials
Shared credentials
Summary
Security and Lock-down
Sensitive credential values are never shown in full to anyone, and Shared credentials can be locked to specific agents. This protects keys and tokens even when a credential is used across a workspace.
Masking. Tokens, API keys, passwords and other key fields are always masked. GenAI Consumer users see only the metadata of a Shared credential, such as its name, service and description. Higher roles see full details, but secrets stay masked.
Locking Shared credentials for agents. A Shared credential can be locked down for agents. When a credential is locked:
- It shows Owner action required in the tool's credential settings.
- Only the owner or an Admin can edit, delete or reauthenticate it.
- Other users can still use it in assets in the mapped workspace.
Workspace mapping. A Shared credential is available only in the workspaces it is mapped to. Assets in other workspaces cannot use it, and users outside those workspaces cannot see it.
Registered Services[NEW]
Registered Services holds OAuth 2.0 applications (Client ID and Client Secret) registered once for the whole tenant, e.g. Corporate GitLab, Jira, Salesforce. Admins register them; every user can then connect through them.
Why Registered Services? An OAuth app only needs to be set up once. An admin registers it with its Client ID and Client Secret. Other users then sign in with their own account through that service, without knowing any technical details or registering their own app. A credential in the Personal or Shared tab is your own sign-in through that app.
Permissions
- The person who registers a service becomes its Owner.
- The Client ID is always masked, and the Client Secret is never shown to anyone.
- Users without edit rights don't see the Edit and Delete icons.
- Each service records Created By, Created At, Last Modified By and Last Modified At.