Using Credentials in Assets[NEW]

Building: Selecting Credentials
Running: Providing Credentials
Who Can Configure What

Building: Selecting Credentials

When you add a tool that needs authentication to an agent or workflow, you choose which credential it uses. Which credentials you see, and which you can create, depend on whether the asset is Public or Private. This applies to ReAct and Prime agents and to Automated Workflows.

Selecting and Creating Credentials While Building

	Public asset	Private asset
Existing credentials shown	Personal and Shared	Personal and Shared
After selecting a credential	Test and Publish	Test and Publish
If you remove (delink) the credential	You can still Publish; the credential is chosen at runtime	You can still Publish; the credential is chosen at runtime
New credentials you can create	Shared only	Personal or Shared
Credential types	OAuth or Key based	OAuth or Key based
Workspace of a new Shared credential	The asset's workspace, by default; add more later in Credentials	The asset's workspace, by default; add more later in Credentials

How To: Add a Credential to a Tool

Open the agent or workflow and add the tool (for example Gmail – Read Email). A tool that needs a credential shows Authentication Required.
Click the badge. The Authentication Required window opens: The tool "Gmail: Read Email" requires authentication to proceed.
In Use the stored account to perform operation(s), open Select account. Credentials are grouped under Personal and Shared.
Pick a credential and click Continue. The credential name now shows on the tool.
If the right credential isn't listed: under If you do not find the appropriate account, please link your account, click the provider (for example Google (OAuth)) or Key based, create the credential, and select it.
Test the asset in Test and Debug, then Publish.

To remove the credential, click the ⊗ on the credential name.

Lock Credential

You can lock the selected credential so the asset always runs with it and it can't be overridden at runtime. Both Personal and Shared credentials can be locked, on Public and Private assets.

Action	Result
Turn on Lock Credential	The selected credential is fixed for testing and runtime
Publish with a locked credential	Users can't override the credential when they run the asset
Change or remove a locked credential	A builder or admin must unlock it, or replace it, first

Making a Private Asset Public

If any tool in the asset uses a Personal credential, you can't make it Public. You'll see:

Personal Credentials in use – Personal credentials are currently in use for one or more tools. Please replace them with shared credentials before proceeding.

Replace each Personal credential with a Shared one, then change the visibility again.

Running: Providing Credentials

When you run an agent, workflow, EGPT or Knowledge Garden, it uses the credential its builder mapped. If none is mapped, you're asked to choose one. This applies to ReAct and Prime agents, Automated Workflows, EGPT and EKGs.

What Happens When You Run an Asset

Situation	Public asset	Private asset
Builder already mapped a credential	Runs with it; nothing to do	Runs with it; nothing to do
No credential mapped	You're asked to select a Personal or Shared credential	You're asked to select a Personal or Shared credential
No suitable credential exists	Create a Shared credential (if your policy allows) from the prompt, Governance or the Credentials module	Same
Builder changes the mapped credential	Access is checked again before the next run	—

Who the credential applies to. If a builder or admin maps the credential, it is saved on the asset for everyone. If you, as a consumer, attach a credential, it applies only to you.

Locked credentials. If the builder locked the credential, you can't change it. The field shows a lock with the tooltip Credential is locked by asset owner. Contact admin to modify.

How To: Provide a Credential at Runtime

In EnterpriseGPT

Ask your question. If a tool needs credentials, the response shows Credentials Expired or the tool list shows Authentication Required next to the tool (for example Gmail, Google Drive, Stripe).
Click the tool. The Authentication Required window opens.
In Select account, choose a credential under Personal or Shared. Shared credentials show the workspaces they belong to.
Click Continue, then ask again.
If no account fits, click Google (OAuth) or Key based under If you do not find the appropriate account, please link your account to create one.

In an agent or workflow you run
The same Authentication Required window appears before the run. Pick a credential and click Continue.

How To (Governance): Configure Tool Credentials for an Asset

Admins can see and fix credentials for every tool in an asset from Governance.

Open Governance and click the settings icon on the asset. Assets with credential issues show a warning icon.
The Tools settings list shows every tool. Tools that need a credential show Authentication Required.
Click the badge, select a credential in the Authentication Required window, and click Continue.
Click Save changes.

Tools inside a sub-agent show the note Any credentials for tools in Sub-agent are managed at the sub-agent level and cannot be modified here. Open the sub-agent to change them.

Who Can Configure What

The same rules apply when building and when running a published asset. On a Private asset, only the owner can configure credentials. On a Public asset, anyone can, but a Shared credential chosen by someone other than the owner applies only to them.

Visibility	Person	Can configure	Allowed types	Personal applies to	Shared applies to
Private	Owner	Yes	Personal Shared Runtime	That user	Everyone
Private	Other user	No	—	—	—
Public	Owner	Yes	Personal Shared Runtime	That user	Everyone
Public	Other user	Yes	Personal Shared Runtime	That user	That user

Everyone means the credential is saved on the asset and applies to everyone who runs it.

Runtime means no credential is mapped while building; the person running the asset chooses one when prompted.