cadau
Log inTry Cadau
ProductAppsSolutionsPlansDocsBlogForumAbout
Log inTry Cadau
← All docs

Member connection credentials (multi-system secrets)

Workspace admins can configure several external-system credentials (API keys, Bearer tokens, etc.) per member. When that member’s agents in this workspace make network requests in

Source help/en/admin-ops/member-secrets.md

Workspace admins can configure several external-system credentials (API keys, Bearer tokens, etc.) per member. When that member’s agents in this workspace make network requests in chat, the server can inject the real secret. Secrets are never shown in the UI or help docs.

Who can configure

  • Workspace owner / admin: under Workspace collaboration → Assistant capability packs → Network requests, open Member connection credentials, add, disable, or delete per member.
  • When adding you can tap AI help fill: paste credential info (key, URL) and call rules (steps, parameters, how to compute dates) together; on successful parse AI saves the credential immediately, optionally also generates a workspace skill (background; when done, open it under connection-area “member skills” or top-bar Skills Center; APIs write {{Name}} placeholders, not real secrets). Workspace admins can view and revise each member’s skills in Skills Center. Only on save failure does it stay in the form for you to edit then tap Save credential.
  • Ordinary members: on the capability-pack page they can see their configured credential names (not secret values), so they cite them correctly in skills.

How to name and cite

ItemNotes
NameStarts with a capital, e.g. CRM_READ, HR_EMPLOYEES; unique per member
Owning systemOptional note, e.g. “CRM”, “HR”, so admins can tell them apart
Allowed hostsOptional; if filled, this credential only works for matching hosts (e.g. crm.katop.com)
How agents use itIn http_request headers or body use {{Name}}, e.g. Authorization: Bearer {{CRM_READ}}

The platform injects the configured credential-name list (not values) into chat context, and the server replaces placeholders before executing the request.

Prerequisites

  1. The platform has enabled the agent HTTP tool (agent_http_tool.enabled).
  2. The workspace has the Network requests capability pack, and the target host is allowed.
  3. Skills or operating rules state API URL, parameters, and {{Name}} cite; do not put real secrets in skill bodies or the knowledge base.

Safety notes

  • Secrets are stored encrypted in the database; production should set MEMBER_SECRETS_ENCRYPTION_KEY (32-byte base64).
  • Tool traces mask Authorization, X-Api-Key, and similar headers.
  • After a member leaves the workspace, delete or disable their credential entries.

Related entries