Skip to main content
Credentials stores authentication for external requests made by Athena. These credentials authenticate Athena to your service. Your Athena developer API key authenticates your application to Athena; provider connections hold model-provider account settings.

​
Add a credential

  1. Open Credentials and choose Add Credential.
  2. Give it a name that identifies the service and environment, such as CRM test.
  3. Select Credential Type and fill in the fields below.
  4. Save it, then select that credential in the HTTP tool, webhook, pre-call lookup, or MCP tool that should use it.
  5. Test against an endpoint you control. Confirm the receiver accepted the authentication without printing its secret values.
For a service requiring two headers, use one Custom Header credential with both rows. Each header name must be unique, ignoring case; values must be single-line. Avoid duplicating an authentication header in both a credential and the tool’s custom headers.

​
Edit or rotate authentication

Open the credential’s edit action. Stored secret values are not returned by credential listings. Leave authentication unchanged when changing only its name or description. Enable Replace authentication details when intentionally rotating the credential, enter the replacement details, and save. Re-test every dependent integration after rotation. Before deleting a credential, replace its references in tools and workflow integrations; deleting it does not revoke the corresponding key at the external service.

​
MCP sign-in credentials

For an external MCP server using OAuth, start Sign in from that MCP tool, complete the service’s authorization flow, and wait for Signed in. The sign-in flow creates the OAuth credential; do not try to create one by pasting a token into the generic credential form. Follow External MCP tools.

​
Troubleshooting

An authentication failure can come from the wrong header name, token format, environment, external permissions, or an expired sign-in. Check the external receiver’s response and the selected credential before changing the agent prompt. Keep authentication secrets out of prompts, model-generated parameters, and screenshots.