> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Store workspace secrets that agents receive as environment variables when they run commands — no pasting keys into chat

Credentials are workspace secrets — API keys, tokens, passwords — stored encrypted and handed to agents as environment variables whenever they run commands. Add a secret once and every agent in the workspace can use it without the value ever appearing in chat.

## Credentials, Connections, or BYOK?

Credentials sit alongside two other places CloudThinker keeps secrets. Use the right one:

| Surface                                    | What it holds                                                                                 | Where                      |
| ------------------------------------------ | --------------------------------------------------------------------------------------------- | -------------------------- |
| [Connections](/guide/connections/overview) | Access to your cloud providers, databases, and monitoring tools                               | **Settings → Connections** |
| **Credentials** (this page)                | Everything else agents need at run time — a vendor API key, a service token, a webhook secret | **Settings → Credentials** |
| [BYOK](/guide/byok)                        | Your own LLM credentials for model inference                                                  | **Admin Settings → BYOK**  |

## Prerequisites

* The **Admin** [workspace role](/guide/workspace-users) — viewing and managing credentials requires permission to edit workspace settings

## Add a credential

<Steps>
  <Step title="Open Settings → Credentials">
    The page lists existing credentials by key name with a search box. Values are never shown here — only key names and descriptions.
  </Step>

  <Step title="Click Add Credential">
    Fill in the form:

    | Field           | What to enter                                                                                                                                                |
    | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
    | **Key**         | The environment-variable name agents will see, e.g. `STRIPE_API_KEY`. Uppercase letters, digits, and underscores only; lowercase input is uppercased for you |
    | **Value**       | The secret itself                                                                                                                                            |
    | **Description** | Optional note on what the secret is for and where it came from                                                                                               |
  </Step>

  <Step title="Save">
    **Success state:** the credential appears in the list, showing its key, description, and last-updated date. The value is not displayed again.
  </Step>
</Steps>

<Note>
  Keys with platform-reserved prefixes — `AWS_`, `GOOGLE_`, `AZURE_`, `KUBECONFIG`, `GITHUB_TOKEN`, `GITLAB_TOKEN`, `BITBUCKET_TOKEN` — are rejected. That access comes from [Connections](/guide/connections/overview), not from this page.
</Note>

## Edit or delete a credential

* **Edit** a credential from its card menu to change the description or replace the value. Leaving the value box blank keeps the stored secret — a blank value never overwrites it.
* **Delete** removes the credential permanently; agents lose access on their next run.

## Reference a credential in a prompt

Type `$` in the chat composer to open the credential picker, then select a key. The token is inserted as `$KEY`, so you can point an agent at a secret without pasting it:

```text theme={null}
@alex #report summarize this month's failed payments from the Stripe API using $STRIPE_API_KEY
```

The agent receives the value as an environment variable and uses it in the commands it runs. The `$` picker appears for members who can edit workspace settings. See [CloudThinker Language](/guide/language) for the full token syntax.

## How agents use credentials

* Every credential in the workspace is injected as an environment variable into the commands agents run, whether or not your prompt references it.
* When an agent needs a secret the workspace doesn't hold, it can ask you for it with a secure form in chat. Submitted values are saved as workspace credentials — the list marks these entries with the agent that added them.
* Secret values never appear in chat or in agent output. Agents see and report key names only.

<Warning>
  An agent asking to collect a key that already exists will overwrite the stored value. Check the Credentials list before submitting if the key might be in use elsewhere.
</Warning>

## Security

* Values are encrypted at rest and are never returned to the browser — the list and edit views expose key names and descriptions only.
* Every credential create, update, and delete is recorded in [Audit Logs](/guide/security/audit-logs) under the Security category, by key name and never by value.

## Next steps

<CardGroup cols={2}>
  <Card title="Connections" icon="plug" href="/guide/connections/overview">
    Connect cloud providers and services — the credential store for your infrastructure access
  </Card>

  <Card title="CloudThinker Language" icon="message" href="/guide/language">
    Learn every composer token — @agents, #tools, /commands, and \$credentials
  </Card>

  <Card title="Bring Your Own Key (BYOK)" icon="key" href="/guide/byok">
    Route LLM inference through your own model credentials
  </Card>

  <Card title="Audit Logs" icon="clipboard-list" href="/guide/security/audit-logs">
    Review who created, changed, or deleted each credential
  </Card>
</CardGroup>