Credentials
Workspace secrets for workflow nodes: how to store them, why values are never read back, and how they differ from connectors.
Credentials are a named set of secrets a workflow uses to reach external systems: SMTP settings, an API key, a connection string. The secret is stored once and nodes reference it by name — the workflow document itself never holds a password.
Not to be confused with connectors. Credentials are for workflow nodes. A connector is access an agent receives during its tasks. Two mechanisms, two sets of access rules.
How they work
- They belong to the workspace and are available only inside it.
- They are a flat set of keys and values —
host,port,username,password, and so on. Which keys a node expects is stated in that node's settings. - They have no type. When a node asks you to pick credentials, it shows every entry in the workspace and you choose by name. So name them after the service: "Corporate SMTP", "Billing API".
- They are stored encrypted. A value is decrypted at the moment of the node's outbound call and never lands in the run history or a step's output.
Values are write-only
This is the rule that matters: a stored secret cannot be read back through the app.
- Viewing shows the name and the key names, never the values.
- Editing either keeps the secret as it is or replaces the whole set of values. Revealing the current password is not possible.
There is deliberately no "show password". If you are unsure what is stored, enter the values again — and keep your own record of what lives where.
Who manages them
Creating, editing, and deleting credentials is for admins and owners. Other members see the list of names, which is enough to pick an entry in a node's settings and not enough to learn a secret.
Using them in a workflow
A node that needs a secret offers a credentials picker in its properties. The node stores a reference, not the value.
If the chosen entry is missing a key the node expects, the step fails with a clear error naming what was missing — a wrong pick shows itself instead of turning into a silent failure.
The canonical example is the Send email node: it takes the SMTP settings from the credentials you picked and sends the mail through your own server.
Deleting
Deletion is irreversible, and the workflow steps that referenced the entry will fail until another one is picked. Check that nothing still uses it first.
Next
- Workflows — where credentials are used.
- Connectors — access for agents, not for nodes.
- Members and roles — who may manage secrets.
Workflows
A process assembled on a canvas: steps, conditions, external calls, and waits. Versions, runs, and how a workflow differs from an autopilot.
Webhooks
Receiving events from external systems: the address, the format, what the assignee gets, response codes, deduplication, the delivery log, and security.