> ## Documentation Index
> Fetch the complete documentation index at: https://docs.utari.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials Manager

> Manage API keys and authentication for external services, securely connecting your agents to third-party platforms and tools through credential profiles.

## Overview

The Credentials Manager enables your Utari workers to securely manage authentication for external services and integrations. Through Composio credential profiles, you can connect agents to third-party platforms, manage API keys, handle OAuth flows, and control which services your agents can access—all while maintaining security and separation of credentials.

## What are Credential Profiles?

<Card title="Understanding Credential Profiles" icon="key">
  Credential profiles are secure containers for authentication information that allow your agents to connect to external services. Each profile:

  * **Stores authentication** (API keys, OAuth tokens, credentials)
  * **Connects to specific toolkits** (Slack, Google, Salesforce, etc.)
  * **Can be assigned to multiple agents** for shared access
  * **Maintains security** through encrypted storage
  * **Enables selective access** by controlling which agents use which profiles
</Card>

<Info>
  Think of credential profiles as secure keychains: one profile per service, reusable across multiple agents, managed centrally for security.
</Info>

## Credentials Manager Capabilities

<CardGroup cols={2}>
  <Card title="Create Profile" icon="plus">
    Set up new credential profiles for connecting to external services
  </Card>

  <Card title="Get Profiles" icon="list">
    View all existing credential profiles and their connection status
  </Card>

  <Card title="Configure for Agent" icon="link">
    Assign credential profiles to specific agents with selected tools
  </Card>

  <Card title="Delete Profile" icon="trash">
    Remove credential profiles that are no longer needed
  </Card>
</CardGroup>

## Managing Credential Profiles

### Creating a New Credential Profile

<Steps>
  <Step title="Initiate Profile Creation">
    Request creation of a credential profile for a specific service:

    ```
        Create a credential profile for Slack
        Set up authentication for Google Drive
        Add a credential profile for Salesforce
    ```
  </Step>

  <Step title="Worker Creates Profile">
    Your worker:

    * Creates the Composio credential profile
    * Generates an authentication link
    * Returns the link for you to complete connection
  </Step>

  <Step title="Complete Authentication">
    Click the provided authentication link to:

    * Authorize access to the service
    * Grant required permissions
    * Complete OAuth flow or enter API key
    * Confirm connection
  </Step>

  <Step title="Verify Connection">
    ```
        Authentication successful! 
        
        Profile created: slack-profile-123
        Toolkit: Slack
        Status: Connected
        
        You can now use this profile with your agents.
    ```
  </Step>

  <Step title="Assign to Agents">
    Configure agents to use the new credential profile for accessing the service.
  </Step>
</Steps>

### Viewing Existing Profiles

<Steps>
  <Step title="Request Profile List">
    Ask to see all your credential profiles:

    ```
        Show me all my credential profiles
        List my connected integrations
        What services do I have authentication for?
    ```
  </Step>

  <Step title="Review Profiles">
    Worker displays all existing profiles:

    ```
        Your Credential Profiles:
        
        1. slack-main
           Toolkit: Slack
           Status: Connected
           Created: 2024-11-15
           Used by: Marketing Agent, Support Agent
        
        2. google-workspace
           Toolkit: Google (Gmail, Drive, Calendar)
           Status: Connected
           Created: 2024-11-10
           Used by: Assistant Agent, Research Agent
        
        3. salesforce-prod
           Toolkit: Salesforce
           Status: Connected
           Created: 2024-11-01
           Used by: Sales Agent
        
        4. github-dev
           Toolkit: GitHub
           Status: Connected
           Created: 2024-10-20
           Used by: Dev Agent
    ```
  </Step>

  <Step title="Check Profile Details">
    Get more information about specific profiles:

    ```
        Show me details for the slack-main profile
        Which agents use the google-workspace profile?
        When was the salesforce-prod profile created?
    ```
  </Step>
</Steps>

### Configuring Profiles for Agents

<Steps>
  <Step title="Select Profile and Agent">
    Specify which profile to assign to which agent:

    ```
        Configure the slack-main profile for my Marketing Agent
        Add the google-workspace profile to my Assistant Agent
        Set up the salesforce-prod profile for the Sales Agent
    ```
  </Step>

  <Step title="Select Tools">
    Choose which tools from the toolkit the agent can access:

    ```
        For Slack profile, enable:
        - Send message
        - Upload file
        - Get channels
        
        (Don't enable delete message or admin functions)
    ```
  </Step>

  <Step title="Worker Configures">
    Your worker:

    * Links the credential profile to the agent
    * Enables selected tools
    * Verifies connection
    * Confirms configuration
  </Step>

  <Step title="Test Connection">
    ```
        Slack profile configured for Marketing Agent
        
        Enabled tools:
        ✓ Send message
        ✓ Upload file
        ✓ Get channels
        
        Test: Send a test message to #general
    ```
  </Step>
</Steps>

### Deleting Credential Profiles

<Steps>
  <Step title="Identify Profile to Remove">
    ```
        Delete the old-slack-profile
        Remove the salesforce-test credential profile
    ```
  </Step>

  <Step title="Confirm Deletion">
    Worker checks if profile is in use:

    ```
        Warning: slack-old is used by Marketing Agent
        
        Removing this profile will:
        - Disconnect Marketing Agent from Slack
        - Remove authentication
        - Cannot be undone
        
        Confirm deletion?
    ```
  </Step>

  <Step title="Worker Removes Profile">
    Upon confirmation:

    * Profile is deleted from Composio
    * Removed from all agent configurations
    * Authentication is revoked
    * Connection is terminated
  </Step>

  <Step title="Update Affected Agents">
    ```
        Profile deleted successfully
        
        Affected agents:
        - Marketing Agent (no longer has Slack access)
        
        Recommendation: Configure a new profile if Slack access is still needed
    ```
  </Step>
</Steps>

## Common Credential Profile Workflows

### Setting Up a New Integration

<Steps>
  <Step title="Create Profile">
    ```
        Create a credential profile for HubSpot
    ```
  </Step>

  <Step title="Complete Authentication">
    ```
        Click authentication link → Authorize HubSpot → Grant permissions → Return to Utari
    ```
  </Step>

  <Step title="Configure for Agent">
    ```
        Add the hubspot-main profile to my Sales Agent
        Enable tools: Get contacts, Create deals, Update opportunities
    ```
  </Step>

  <Step title="Test Integration">
    ```
        Test by creating a sample contact in HubSpot
    ```
  </Step>

  <Step title="Build Workflows">
    ```
        Now Sales Agent can:
        - Sync contacts from HubSpot
        - Create new deals
        - Update opportunity stages
        - Track sales activities
    ```
  </Step>
</Steps>

### Managing Multiple Environments

<Steps>
  <Step title="Create Environment-Specific Profiles">
    ```
        Create credential profiles:
        - salesforce-dev (for testing)
        - salesforce-staging (for QA)
        - salesforce-prod (for production)
    ```
  </Step>

  <Step title="Assign to Different Agents">
    ```
        - Development Agent: Use salesforce-dev
        - QA Agent: Use salesforce-staging
        - Sales Agent: Use salesforce-prod
    ```
  </Step>

  <Step title="Control Access">
    ```
        Ensure agents can't accidentally:
        - Test in production
        - Modify production data during development
        - Mix environment data
    ```
  </Step>
</Steps>

### Team Collaboration Setup

<Steps>
  <Step title="Create Shared Profiles">
    ```
        Create profiles for team services:
        - slack-team (team communication)
        - google-shared (shared workspace)
        - notion-team (documentation)
    ```
  </Step>

  <Step title="Distribute to Agents">
    ```
        All agents get:
        - slack-team (for notifications)
        - notion-team (for documentation)
        
        Specific agents get:
        - google-shared (only for agents that need it)
    ```
  </Step>

  <Step title="Maintain Consistency">
    ```
        Using shared profiles ensures:
        - Consistent access across agents
        - Centralized credential management
        - Easy updates when credentials change
    ```
  </Step>
</Steps>

## Authentication Types

### OAuth (Most Common)

<Card title="OAuth Flow" icon="shield-check">
  **Process**:

  1. Create credential profile
  2. Click authentication link
  3. Authorize in browser
  4. Grant requested permissions
  5. Automatic token management

  **Platforms**: Google, Slack, Salesforce, Microsoft, GitHub, LinkedIn, most SaaS

  **Benefits**:

  * Secure, browser-based
  * No passwords stored
  * Automatic token refresh
  * Granular permissions

  **Example**:

  ```
    Create profile for Google Drive
    → Click auth link
    → "Allow Utari to access Google Drive?"
    → Grant permission
    → Connected!
  ```
</Card>

### API Key Authentication

<Card title="API Key Flow" icon="key">
  **Process**:

  1. Get API key from service
  2. Create credential profile
  3. Enter API key when prompted
  4. Validate connection

  **Platforms**: OpenAI, Anthropic, SendGrid, Stripe, custom APIs

  **Considerations**:

  * More manual setup
  * Keys must be kept secure
  * No automatic expiration
  * Full account access

  **Example**:

  ```
    Create profile for OpenAI
    → Enter API key: sk-...
    → Validate
    → Connected!
  ```
</Card>

### Username/Password Authentication

<Card title="Credentials Flow" icon="user-lock">
  **Process**:

  1. Create credential profile
  2. Enter username and password
  3. May require 2FA
  4. Credentials stored securely

  **Platforms**: Legacy systems, databases, internal tools

  **Considerations**:

  * Less secure than OAuth
  * Manual updates needed
  * May require periodic re-auth

  **Example**:

  ```
    Create profile for internal database
    → Enter username: admin
    → Enter password: [secure]
    → Connected!
  ```
</Card>

## Credential Profile Best Practices

<CardGroup cols={2}>
  <Card title="One Profile Per Service" icon="fingerprint">
    Create separate profiles for each service/platform rather than reusing credentials
  </Card>

  <Card title="Descriptive Naming" icon="tag">
    Use clear, descriptive names: "slack-marketing" instead of "profile-1"
  </Card>

  <Card title="Environment Separation" icon="layer-group">
    Maintain separate profiles for dev, staging, and production environments
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Only grant the minimum permissions necessary for each agent's tasks
  </Card>

  <Card title="Regular Audits" icon="clipboard-check">
    Periodically review which profiles exist and which agents use them
  </Card>

  <Card title="Remove Unused" icon="trash">
    Delete profiles that are no longer needed to reduce security surface
  </Card>

  <Card title="Document Purpose" icon="book">
    Keep notes on why each profile exists and which workflows use it
  </Card>

  <Card title="Secure Credentials" icon="lock">
    Never share credential profiles or authentication links publicly
  </Card>
</CardGroup>

## Profile Naming Conventions

### Recommended Patterns

<CodeGroup>
  ```text By Service + Purpose theme={null}
  slack-marketing
  slack-support
  google-personal
  google-team
  salesforce-sales
  salesforce-marketing
  ```

  ```text By Environment theme={null}
  github-dev
  github-staging
  github-prod
  database-test
  database-production
  ```

  ```text By Team/Department theme={null}
  notion-engineering
  notion-product
  hubspot-sales
  hubspot-marketing
  ```

  ```text By Function theme={null}
  gmail-outreach
  gmail-notifications
  drive-backups
  drive-collaboration
  ```
</CodeGroup>

### Naming Best Practices

<AccordionGroup>
  <Accordion title="Be Descriptive" icon="comment">
    ✅ `slack-customer-support`

    ❌ `slack1`

    Clear names help identify purpose at a glance
  </Accordion>

  <Accordion title="Include Context" icon="circle-info">
    ✅ `salesforce-prod-sales-team`

    ❌ `sf`

    Context prevents confusion when multiple profiles exist
  </Accordion>

  <Accordion title="Use Consistent Format" icon="align-left">
    ✅ All profiles use format: `service-environment-purpose`

    ❌ Mix of formats: `slack_dev`, `prodGoogle`, `salesforce-marketing`

    Consistency aids organization and discovery
  </Accordion>

  <Accordion title="Avoid Special Characters" icon="ban">
    ✅ `google-drive-backups`

    ❌ `google/drive (backups)!`

    Use hyphens or underscores, avoid spaces and symbols
  </Accordion>
</AccordionGroup>

## Security Considerations

### Credential Security

<Warning>
  **Critical Security Practices**:

  * Never share authentication links publicly
  * Don't include credentials in prompts or instructions
  * Use separate profiles for different security levels
  * Regularly rotate API keys and tokens
  * Review granted permissions periodically
  * Delete unused profiles immediately
  * Monitor agent access patterns
  * Use OAuth over API keys when possible
</Warning>

### Access Control

<Steps>
  <Step title="Principle of Least Privilege">
    ```
        Only grant the minimum permissions needed:
        
        ✅ Marketing Agent: Send Slack messages
        ❌ Marketing Agent: Delete channels, manage users
        
        ✅ Research Agent: Read Google Sheets
        ❌ Research Agent: Delete files, manage permissions
    ```
  </Step>

  <Step title="Separate Production and Testing">
    ```
        Development Agent → test-profile (safe to experiment)
        Production Agent → prod-profile (restricted access)
        
        Never use production credentials in development agents
    ```
  </Step>

  <Step title="Regular Permission Reviews">
    ```
        Monthly audit:
        - Which profiles exist?
        - Which agents use each profile?
        - Are permissions still appropriate?
        - Any unused profiles to delete?
    ```
  </Step>
</Steps>

### Credential Rotation

<Steps>
  <Step title="Identify Rotation Need">
    Rotate credentials when:

    * Regular schedule (quarterly, annually)
    * Team member leaves
    * Suspected compromise
    * Service recommends rotation
  </Step>

  <Step title="Create New Profile">
    ```
        Create new profile: slack-main-v2
        Authenticate with new credentials
    ```
  </Step>

  <Step title="Update Agent Configurations">
    ```
        Switch agents from slack-main to slack-main-v2
        Test all functionality
    ```
  </Step>

  <Step title="Delete Old Profile">
    ```
        Once verified working:
        Delete slack-main profile
        Revoke old credentials at service
    ```
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication link doesn't work">
    Try:

    * Opening in a different browser
    * Clearing browser cache and cookies
    * Disabling browser extensions
    * Checking for popup blockers
    * Requesting a new authentication link
    * Ensure you're logged into the service
  </Accordion>

  <Accordion title="Profile shows as disconnected">
    Verify:

    * Authentication was completed successfully
    * Required permissions were granted
    * Account credentials are still valid
    * Service hasn't revoked access
    * Try re-authenticating the profile
    * Check service-side connection settings
  </Accordion>

  <Accordion title="Agent can't access profile tools">
    Check:

    * Profile is configured for the agent
    * Required tools are enabled
    * Profile is connected and authenticated
    * Agent has correct profile assigned
    * Permissions on service allow the action
  </Accordion>

  <Accordion title="Can't delete profile">
    Ensure:

    * Profile is not in use by active agents
    * Remove profile from all agent configurations first
    * Wait a moment and try again
    * Check if you have deletion permissions
  </Accordion>

  <Accordion title="Multiple profiles for same service causing confusion">
    Organize:

    * Use clear, descriptive naming
    * Document which profile is for what
    * Delete unused duplicate profiles
    * Standardize on one profile per use case
    * Consider environment-specific naming
  </Accordion>

  <Accordion title="OAuth token expired or invalid">
    Solutions:

    * Re-authenticate the profile
    * Create new profile if re-auth fails
    * Check service account status
    * Verify permissions weren't revoked
    * Some services require periodic re-authorization
  </Accordion>
</AccordionGroup>

## Advanced Credential Management

### Multi-Account Management

<Steps>
  <Step title="Create Profiles for Each Account">
    ```
        For multiple Slack workspaces:
        - slack-company-a
        - slack-company-b
        - slack-company-c
    ```
  </Step>

  <Step title="Assign to Dedicated Agents">
    ```
        Company A Agent → slack-company-a
        Company B Agent → slack-company-b
        Company C Agent → slack-company-c
        
        Prevents cross-posting to wrong workspace
    ```
  </Step>

  <Step title="Use Template Variables">
    ```
        Create reusable workflows:
        "Post to {{company_workspace}} Slack"
        
        Each agent substitutes its company value
    ```
  </Step>
</Steps>

### Credential Profile Templates

<CodeGroup>
  ```text Marketing Stack theme={null}
  Profiles to create:
  - google-analytics (tracking)
  - mailchimp-marketing (email)
  - hubspot-marketing (automation)
  - twitter-brand (social)
  - linkedin-company (professional)

  Configure all for Marketing Agent
  ```

  ```text Sales Stack theme={null}
  Profiles to create:
  - salesforce-sales (CRM)
  - gmail-outreach (communication)
  - linkedin-sales (prospecting)
  - calendly-meetings (scheduling)

  Configure all for Sales Agent
  ```

  ```text Development Stack theme={null}
  Profiles to create:
  - github-main (code)
  - jira-project (tickets)
  - slack-dev (communication)
  - aws-deploy (infrastructure)

  Configure all for Dev Agent
  ```

  ```text Support Stack theme={null}
  Profiles to create:
  - zendesk-support (tickets)
  - slack-support (team)
  - notion-kb (knowledge base)
  - gmail-support (email)

  Configure all for Support Agent
  ```
</CodeGroup>

## Summary

You've successfully learned how to:

<Check>
  Create credential profiles for external services
</Check>

<Check>
  View and manage all existing credential profiles
</Check>

<Check>
  Configure credential profiles for specific agents with selected tools
</Check>

<Check>
  Delete credential profiles when no longer needed
</Check>

<Check>
  Understand different authentication types (OAuth, API Key, Credentials)
</Check>

<Check>
  Apply security best practices for credential management
</Check>

<Check>
  Organize profiles with clear naming conventions
</Check>

<Check>
  Troubleshoot common credential and authentication issues
</Check>

The Credentials Manager provides secure, centralized authentication management for all your external integrations. By properly managing credential profiles, you maintain security while enabling your agents to access the services they need to automate workflows and complete tasks.

## Next Steps

<CardGroup cols={2}>
  <Card title="MCP Server Search" icon="magnifying-glass" href="/tools/mcp-server-search">
    Discover services to create credential profiles for
  </Card>

  <Card title="Agent Configuration" icon="sliders" href="/tools/agent-configuration">
    Configure agents to use credential profiles
  </Card>

  <Card title="Integrations Guide" icon="plug" href="/integrations">
    Learn about available integrations
  </Card>

  <Card title="Security Best Practices" icon="shield-check" href="/security">
    Advanced security guidance
  </Card>
</CardGroup>