Skip to main content
Credentials are workspace secrets — API keys, tokens, passwords — stored encrypted and handed to agents as environment variables whenever they run commands. Add a secret once and every agent in the workspace can use it without the value ever appearing in chat.

​
Credentials, Connections, or BYOK?

Credentials sit alongside two other places CloudThinker keeps secrets. Use the right one:

​
Prerequisites

  • The Admin workspace role — viewing and managing credentials requires permission to edit workspace settings

​
Add a credential

1

Open Settings → Credentials

The page lists existing credentials by key name with a search box. Values are never shown here — only key names and descriptions.
2

Click Add Credential

Fill in the form:
3

Save

Success state: the credential appears in the list, showing its key, description, and last-updated date. The value is not displayed again.
Keys with platform-reserved prefixes — AWS_, GOOGLE_, AZURE_, KUBECONFIG, GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN — are rejected. That access comes from Connections, not from this page.

​
Edit or delete a credential

  • Edit a credential from its card menu to change the description or replace the value. Leaving the value box blank keeps the stored secret — a blank value never overwrites it.
  • Delete removes the credential permanently; agents lose access on their next run.

​
Reference a credential in a prompt

Type $ in the chat composer to open the credential picker, then select a key. The token is inserted as $KEY, so you can point an agent at a secret without pasting it:
The agent receives the value as an environment variable and uses it in the commands it runs. The $ picker appears for members who can edit workspace settings. See CloudThinker Language for the full token syntax.

​
How agents use credentials

  • Every credential in the workspace is injected as an environment variable into the commands agents run, whether or not your prompt references it.
  • When an agent needs a secret the workspace doesn’t hold, it can ask you for it with a secure form in chat. Submitted values are saved as workspace credentials — the list marks these entries with the agent that added them.
  • Secret values never appear in chat or in agent output. Agents see and report key names only.
An agent asking to collect a key that already exists will overwrite the stored value. Check the Credentials list before submitting if the key might be in use elsewhere.

​
Security

  • Values are encrypted at rest and are never returned to the browser — the list and edit views expose key names and descriptions only.
  • Every credential create, update, and delete is recorded in Audit Logs under the Security category, by key name and never by value.

​
Next steps

Connections

Connect cloud providers and services — the credential store for your infrastructure access

CloudThinker Language

Learn every composer token — @agents, #tools, /commands, and $credentials

Bring Your Own Key (BYOK)

Route LLM inference through your own model credentials

Audit Logs

Review who created, changed, or deleted each credential