> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterspeed.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool credentials

> API keys for the external services a task configuration's capabilities call during a run.

**Tool credentials** are the keys for external services that a task configuration uses through its capabilities — an Enterspeed index it looks data up in, an external MCP server, or another service it calls during generation.

Find them under **Settings → Tool Credentials**.

## How they are used

A capability references a credential by **alias** rather than carrying the key itself. That means:

* The key is stored once and used by any number of configurations
* Rotating the key does not require touching a configuration
* A configuration document can be read, reviewed, and version-controlled without exposing secrets

<Info>
  This is why tool capabilities are configured in the UI rather than through the management API — they need platform-side credentials wired up first.
</Info>

## Creating one

<Steps>
  <Step title="Add a credential">
    Give it an alias that names the service and its role, such as `pim-lookup`.
  </Step>

  <Step title="Paste the external service's key">
    It is stored encrypted and is not readable back out afterwards.
  </Step>

  <Step title="Reference the alias from a capability">
    In the task configuration, under **AI can also…**. [Capabilities](/speedtrain/key-concepts/capabilities)
  </Step>
</Steps>

<Warning>
  A credential that a capability references must exist in the same environment. A configuration promoted from `Demo` to `Production` needs its credentials to exist in `Production` too, or the capability fails at run time.
</Warning>

## Least privilege

Give each credential the narrowest access that works. A read-only key for a lookup capability cannot be used to change anything if it leaks, and the capability does not need more.