Skip to main content
Tool credentials are the keys for external services that a task configuration uses through its capabilities — an Enterspeed index it looks data up in, an external MCP server, or another service it calls during generation. Find them under Settings → Tool Credentials.

​
How they are used

A capability references a credential by alias rather than carrying the key itself. That means:
  • The key is stored once and used by any number of configurations
  • Rotating the key does not require touching a configuration
  • A configuration document can be read, reviewed, and version-controlled without exposing secrets
This is why tool capabilities are configured in the UI rather than through the management API — they need platform-side credentials wired up first.

​
Creating one

1

Add a credential

Give it an alias that names the service and its role, such as pim-lookup.
2

Paste the external service's key

It is stored encrypted and is not readable back out afterwards.
3

Reference the alias from a capability

In the task configuration, under AI can also…. Capabilities
A credential that a capability references must exist in the same environment. A configuration promoted from Demo to Production needs its credentials to exist in Production too, or the capability fails at run time.

​
Least privilege

Give each credential the narrowest access that works. A read-only key for a lookup capability cannot be used to change anything if it leaks, and the capability does not need more.