Credentials Manager - Utari Docs

Overview

The Credentials Manager enables your Utari workers to securely manage authentication for external services and integrations. Through Composio credential profiles, you can connect agents to third-party platforms, manage API keys, handle OAuth flows, and control which services your agents can access—all while maintaining security and separation of credentials.

What are Credential Profiles?

Understanding Credential Profiles

Credential profiles are secure containers for authentication information that allow your agents to connect to external services. Each profile:

Stores authentication (API keys, OAuth tokens, credentials)
Connects to specific toolkits (Slack, Google, Salesforce, etc.)
Can be assigned to multiple agents for shared access
Maintains security through encrypted storage
Enables selective access by controlling which agents use which profiles

Think of credential profiles as secure keychains: one profile per service, reusable across multiple agents, managed centrally for security.

Credentials Manager Capabilities

Create Profile

Set up new credential profiles for connecting to external services

Get Profiles

View all existing credential profiles and their connection status

Configure for Agent

Assign credential profiles to specific agents with selected tools

Delete Profile

Remove credential profiles that are no longer needed

Managing Credential Profiles

Creating a New Credential Profile

Initiate Profile Creation

Request creation of a credential profile for a specific service:

    Create a credential profile for Slack
    Set up authentication for Google Drive
    Add a credential profile for Salesforce

Worker Creates Profile

Your worker:

Creates the Composio credential profile
Generates an authentication link
Returns the link for you to complete connection

Complete Authentication

Click the provided authentication link to:

Authorize access to the service
Grant required permissions
Complete OAuth flow or enter API key
Confirm connection

Verify Connection

    Authentication successful! 
    
    Profile created: slack-profile-123
    Toolkit: Slack
    Status: Connected
    
    You can now use this profile with your agents.

Assign to Agents

Configure agents to use the new credential profile for accessing the service.

Viewing Existing Profiles

Request Profile List

Ask to see all your credential profiles:

    Show me all my credential profiles
    List my connected integrations
    What services do I have authentication for?

Review Profiles

Worker displays all existing profiles:

    Your Credential Profiles:
    
    1. slack-main
       Toolkit: Slack
       Status: Connected
       Created: 2024-11-15
       Used by: Marketing Agent, Support Agent
    
    2. google-workspace
       Toolkit: Google (Gmail, Drive, Calendar)
       Status: Connected
       Created: 2024-11-10
       Used by: Assistant Agent, Research Agent
    
    3. salesforce-prod
       Toolkit: Salesforce
       Status: Connected
       Created: 2024-11-01
       Used by: Sales Agent
    
    4. github-dev
       Toolkit: GitHub
       Status: Connected
       Created: 2024-10-20
       Used by: Dev Agent

Check Profile Details

Get more information about specific profiles:

    Show me details for the slack-main profile
    Which agents use the google-workspace profile?
    When was the salesforce-prod profile created?

Configuring Profiles for Agents

Select Profile and Agent

Specify which profile to assign to which agent:

    Configure the slack-main profile for my Marketing Agent
    Add the google-workspace profile to my Assistant Agent
    Set up the salesforce-prod profile for the Sales Agent

Select Tools

Choose which tools from the toolkit the agent can access:

    For Slack profile, enable:
    - Send message
    - Upload file
    - Get channels
    
    (Don't enable delete message or admin functions)

Worker Configures

Your worker:

Links the credential profile to the agent
Enables selected tools
Verifies connection
Confirms configuration

Test Connection

    Slack profile configured for Marketing Agent
    
    Enabled tools:
    ✓ Send message
    ✓ Upload file
    ✓ Get channels
    
    Test: Send a test message to #general

Deleting Credential Profiles

Identify Profile to Remove

    Delete the old-slack-profile
    Remove the salesforce-test credential profile

Confirm Deletion

Worker checks if profile is in use:

    Warning: slack-old is used by Marketing Agent
    
    Removing this profile will:
    - Disconnect Marketing Agent from Slack
    - Remove authentication
    - Cannot be undone
    
    Confirm deletion?

Worker Removes Profile

Upon confirmation:

Profile is deleted from Composio
Removed from all agent configurations
Authentication is revoked
Connection is terminated

Update Affected Agents

    Profile deleted successfully
    
    Affected agents:
    - Marketing Agent (no longer has Slack access)
    
    Recommendation: Configure a new profile if Slack access is still needed

Common Credential Profile Workflows

Setting Up a New Integration

Create Profile

    Create a credential profile for HubSpot

Complete Authentication

    Click authentication link → Authorize HubSpot → Grant permissions → Return to Utari

Configure for Agent

    Add the hubspot-main profile to my Sales Agent
    Enable tools: Get contacts, Create deals, Update opportunities

Test Integration

    Test by creating a sample contact in HubSpot

Build Workflows

    Now Sales Agent can:
    - Sync contacts from HubSpot
    - Create new deals
    - Update opportunity stages
    - Track sales activities

Managing Multiple Environments

Create Environment-Specific Profiles

    Create credential profiles:
    - salesforce-dev (for testing)
    - salesforce-staging (for QA)
    - salesforce-prod (for production)

Assign to Different Agents

    - Development Agent: Use salesforce-dev
    - QA Agent: Use salesforce-staging
    - Sales Agent: Use salesforce-prod

Control Access

    Ensure agents can't accidentally:
    - Test in production
    - Modify production data during development
    - Mix environment data

Team Collaboration Setup

Create Shared Profiles

    Create profiles for team services:
    - slack-team (team communication)
    - google-shared (shared workspace)
    - notion-team (documentation)

Distribute to Agents

    All agents get:
    - slack-team (for notifications)
    - notion-team (for documentation)
    
    Specific agents get:
    - google-shared (only for agents that need it)

Maintain Consistency

    Using shared profiles ensures:
    - Consistent access across agents
    - Centralized credential management
    - Easy updates when credentials change

Authentication Types

OAuth (Most Common)

OAuth Flow

Process:

Create credential profile
Click authentication link
Authorize in browser
Grant requested permissions
Automatic token management

Platforms: Google, Slack, Salesforce, Microsoft, GitHub, LinkedIn, most SaaSBenefits:

Secure, browser-based
No passwords stored
Automatic token refresh
Granular permissions

Example:

  Create profile for Google Drive
  → Click auth link
  → "Allow Utari to access Google Drive?"
  → Grant permission
  → Connected!

API Key Authentication

API Key Flow

Process:

Get API key from service
Create credential profile
Enter API key when prompted
Validate connection

Platforms: OpenAI, Anthropic, SendGrid, Stripe, custom APIsConsiderations:

More manual setup
Keys must be kept secure
No automatic expiration
Full account access

Example:

  Create profile for OpenAI
  → Enter API key: sk-...
  → Validate
  → Connected!

Username/Password Authentication

Credentials Flow

Process:

Create credential profile
Enter username and password
May require 2FA
Credentials stored securely

Platforms: Legacy systems, databases, internal toolsConsiderations:

Less secure than OAuth
Manual updates needed
May require periodic re-auth

Example:

  Create profile for internal database
  → Enter username: admin
  → Enter password: [secure]
  → Connected!

Credential Profile Best Practices

One Profile Per Service

Create separate profiles for each service/platform rather than reusing credentials

Descriptive Naming

Use clear, descriptive names: “slack-marketing” instead of “profile-1”

Environment Separation

Maintain separate profiles for dev, staging, and production environments

Least Privilege

Only grant the minimum permissions necessary for each agent’s tasks

Regular Audits

Periodically review which profiles exist and which agents use them

Remove Unused

Delete profiles that are no longer needed to reduce security surface

Document Purpose

Keep notes on why each profile exists and which workflows use it

Secure Credentials

Never share credential profiles or authentication links publicly

Profile Naming Conventions

Recommended Patterns

slack-marketing
slack-support
google-personal
google-team
salesforce-sales
salesforce-marketing

github-dev
github-staging
github-prod
database-test
database-production

notion-engineering
notion-product
hubspot-sales
hubspot-marketing

gmail-outreach
gmail-notifications
drive-backups
drive-collaboration

Naming Best Practices

Be Descriptive

✅ slack-customer-support❌ slack1Clear names help identify purpose at a glance

Include Context

✅ salesforce-prod-sales-team❌ sfContext prevents confusion when multiple profiles exist

Use Consistent Format

✅ All profiles use format: service-environment-purpose❌ Mix of formats: slack_dev, prodGoogle, salesforce-marketingConsistency aids organization and discovery

Avoid Special Characters

✅ google-drive-backups❌ google/drive (backups)!Use hyphens or underscores, avoid spaces and symbols

Security Considerations

Credential Security

Critical Security Practices:

Never share authentication links publicly
Don’t include credentials in prompts or instructions
Use separate profiles for different security levels
Regularly rotate API keys and tokens
Review granted permissions periodically
Delete unused profiles immediately
Monitor agent access patterns
Use OAuth over API keys when possible

Access Control

Principle of Least Privilege

    Only grant the minimum permissions needed:
    
    ✅ Marketing Agent: Send Slack messages
    ❌ Marketing Agent: Delete channels, manage users
    
    ✅ Research Agent: Read Google Sheets
    ❌ Research Agent: Delete files, manage permissions

Separate Production and Testing

    Development Agent → test-profile (safe to experiment)
    Production Agent → prod-profile (restricted access)
    
    Never use production credentials in development agents

Regular Permission Reviews

    Monthly audit:
    - Which profiles exist?
    - Which agents use each profile?
    - Are permissions still appropriate?
    - Any unused profiles to delete?

Credential Rotation

Identify Rotation Need

Rotate credentials when:

Regular schedule (quarterly, annually)
Team member leaves
Suspected compromise
Service recommends rotation

Create New Profile

    Create new profile: slack-main-v2
    Authenticate with new credentials

Update Agent Configurations

    Switch agents from slack-main to slack-main-v2
    Test all functionality

Delete Old Profile

    Once verified working:
    Delete slack-main profile
    Revoke old credentials at service

Troubleshooting

Authentication link doesn't work

Try:

Opening in a different browser
Clearing browser cache and cookies
Disabling browser extensions
Checking for popup blockers
Requesting a new authentication link
Ensure you’re logged into the service

Profile shows as disconnected

Verify:

Authentication was completed successfully
Required permissions were granted
Account credentials are still valid
Service hasn’t revoked access
Try re-authenticating the profile
Check service-side connection settings

Agent can't access profile tools

Check:

Profile is configured for the agent
Required tools are enabled
Profile is connected and authenticated
Agent has correct profile assigned
Permissions on service allow the action

Can't delete profile

Ensure:

Profile is not in use by active agents
Remove profile from all agent configurations first
Wait a moment and try again
Check if you have deletion permissions

Multiple profiles for same service causing confusion

Organize:

Use clear, descriptive naming
Document which profile is for what
Delete unused duplicate profiles
Standardize on one profile per use case
Consider environment-specific naming

OAuth token expired or invalid

Solutions:

Re-authenticate the profile
Create new profile if re-auth fails
Check service account status
Verify permissions weren’t revoked
Some services require periodic re-authorization

Advanced Credential Management

Multi-Account Management

Create Profiles for Each Account

    For multiple Slack workspaces:
    - slack-company-a
    - slack-company-b
    - slack-company-c

Assign to Dedicated Agents

    Company A Agent → slack-company-a
    Company B Agent → slack-company-b
    Company C Agent → slack-company-c
    
    Prevents cross-posting to wrong workspace

Use Template Variables

    Create reusable workflows:
    "Post to {{company_workspace}} Slack"
    
    Each agent substitutes its company value

Credential Profile Templates

Profiles to create:
- google-analytics (tracking)
- mailchimp-marketing (email)
- hubspot-marketing (automation)
- twitter-brand (social)
- linkedin-company (professional)

Configure all for Marketing Agent

Profiles to create:
- salesforce-sales (CRM)
- gmail-outreach (communication)
- linkedin-sales (prospecting)
- calendly-meetings (scheduling)

Configure all for Sales Agent

Profiles to create:
- github-main (code)
- jira-project (tickets)
- slack-dev (communication)
- aws-deploy (infrastructure)

Configure all for Dev Agent

Profiles to create:
- zendesk-support (tickets)
- slack-support (team)
- notion-kb (knowledge base)
- gmail-support (email)

Configure all for Support Agent

Summary

You’ve successfully learned how to:

Create credential profiles for external services

View and manage all existing credential profiles

Configure credential profiles for specific agents with selected tools

Delete credential profiles when no longer needed

Understand different authentication types (OAuth, API Key, Credentials)

Apply security best practices for credential management

Organize profiles with clear naming conventions

Troubleshoot common credential and authentication issues

The Credentials Manager provides secure, centralized authentication management for all your external integrations. By properly managing credential profiles, you maintain security while enabling your agents to access the services they need to automate workflows and complete tasks.

Next Steps

MCP Server Search

Discover services to create credential profiles for

Agent Configuration

Configure agents to use credential profiles

Integrations Guide

Learn about available integrations

Security Best Practices

Advanced security guidance

​Overview

​What are Credential Profiles?

Understanding Credential Profiles

​Credentials Manager Capabilities

Create Profile

Get Profiles

Configure for Agent

Delete Profile

​Managing Credential Profiles

​Creating a New Credential Profile

​Viewing Existing Profiles

​Configuring Profiles for Agents

​Deleting Credential Profiles

​Common Credential Profile Workflows

​Setting Up a New Integration

​Managing Multiple Environments

​Team Collaboration Setup

​Authentication Types

​OAuth (Most Common)

OAuth Flow

​API Key Authentication

API Key Flow

​Username/Password Authentication

Credentials Flow

​Credential Profile Best Practices

One Profile Per Service

Descriptive Naming

Environment Separation

Least Privilege

Regular Audits

Remove Unused

Document Purpose

Secure Credentials

​Profile Naming Conventions

​Recommended Patterns

​Naming Best Practices

​Security Considerations

​Credential Security

​Access Control

​Credential Rotation

​Troubleshooting

​Advanced Credential Management

​Multi-Account Management

​Credential Profile Templates

​Summary

​Next Steps

MCP Server Search

Agent Configuration

Integrations Guide

Security Best Practices

Overview

What are Credential Profiles?

Credentials Manager Capabilities

Managing Credential Profiles

Creating a New Credential Profile

Viewing Existing Profiles

Configuring Profiles for Agents

Deleting Credential Profiles

Common Credential Profile Workflows

Setting Up a New Integration

Managing Multiple Environments

Team Collaboration Setup

Authentication Types

OAuth (Most Common)

API Key Authentication

Username/Password Authentication

Credential Profile Best Practices

Profile Naming Conventions

Recommended Patterns

Naming Best Practices

Security Considerations

Credential Security

Access Control

Credential Rotation

Troubleshooting

Advanced Credential Management

Multi-Account Management

Credential Profile Templates

Summary

Next Steps