{
  "schema_version": "agentpmt.docs.v1",
  "generated_at": "2026-07-21T14:18:01.508Z",
  "release_id": "645ba065961f3e4869733f1c5ebbd86e4233149ebb79daf3c648378a1d5336d2",
  "id": "69b2e500c481ec10adab7ce1",
  "page_url": "https://www.agentpmt.com/docs/core-concepts/how-credentials-work",
  "markdown_url": "https://www.agentpmt.com/docs/core-concepts/how-credentials-work?format=agent-md",
  "json_url": "https://www.agentpmt.com/docs/core-concepts/how-credentials-work?format=agent-json",
  "source_path": "content/docs/how-credentials-work.mdoc",
  "updated_at": "2026-05-27T04:40:56.000Z",
  "headings": [
    {
      "depth": 2,
      "id": "the-flow",
      "title": "The Flow"
    },
    {
      "depth": 2,
      "id": "security",
      "title": "Security"
    },
    {
      "depth": 2,
      "id": "when-you-dont-need-credentials",
      "title": "When You Don't Need Credentials"
    },
    {
      "depth": 2,
      "id": "managing-credentials",
      "title": "Managing Credentials"
    }
  ],
  "related_products": [],
  "related_workflows": [],
  "doc": {
    "title": "Credentials",
    "description": "Learn how AgentPMT securely manages API keys, OAuth tokens, and passwords your tools need to function.",
    "category": "Core Concepts",
    "image": null,
    "full_path": "core-concepts/how-credentials-work",
    "body_markdown": "# Credentials\n\nSome tools need authentication to work -- an API key for a weather service, OAuth tokens for Google Workspace, or a password for a database. AgentPMT handles these securely through **credentials**.\n\n---\n\n## The Flow\n\n### A tool declares what it needs\n\nEach tool specifies a credential schema: which fields are required (API key, token, username/password, etc.) and what format they should be in.\n\n### You provide the values\n\nIn your dashboard under the **Credentials** tab, you create a credential record and fill in the required fields. Secret values are masked after saving.\n\n### You bind it to an Agent Group\n\nGo to your Agent Group's settings and bind the credential to the relevant tool. This tells AgentPMT: \"When this agent calls this tool using this group, use these credentials.\"\n\n### Agent calls the tool\n\nWhen your agent makes a tool call, AgentPMT automatically injects the bound credentials. The agent never sees your raw secrets.\n\n---\n\n## Security\n\n**Your secrets stay safe**\n\nCredential values are encrypted at rest. Your agent never receives raw credential values -- they are injected server-side when AgentPMT runs the approved integration.\n\n- Secret fields are **masked** in the dashboard after saving\n- Credentials are **encrypted** in the database\n- Credentials are **injected server-side** -- they never pass through your agent\n- Each credential is **scoped to an Agent Group** -- different groups can use different credentials for the same tool\n\n---\n\n## When You Don't Need Credentials\n\nMany tools on AgentPMT work without any credentials. If a tool does not require external-account authentication, you just add it to your Agent Group and go.\n\nYou only need to set up credentials when a tool connects to an external service that requires your own account (for example, your Google account, your Stripe account, or your custom API).\n\n---\n\n## Managing Credentials\n\nFrom your dashboard:\n\n- **Credentials tab** — Create, edit, and delete credential records\n- **Agent Group settings** -- Bind credentials to specific Agent Groups\n- **Missing credential warnings** — If your agent tries to call a tool that needs credentials you haven't provided, you'll see a warning in the chat interface with a link to set them up\n\n### [60 Second Quick Start](https://www.agentpmt.com/docs/getting-started/quick-start)\n\nCreate your first Agent Group and bind credentials\n\n### [API To MCP Tool Conversion](https://www.agentpmt.com/docs/agent-connections/api-to-mcp-tool-conversion)\n\nUse credentials to expose a controlled API endpoint as a private MCP tool\n\n### [What is a Tool](https://www.agentpmt.com/docs/core-concepts/what-is-a-tool)\n\nUnderstand what tools are and how they use credentials\n"
  }
}