> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryopencomputer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage tool credentials

> Authenticate HTTP tools, webhooks, pre-call lookups, and external MCP servers.

**Credentials** stores authentication for external requests made by Athena. These credentials authenticate Athena to your service. Your Athena developer API key authenticates your application to Athena; [provider connections](/guides/models.md) hold model-provider account settings.

## Add a credential

1. Open **Credentials** and choose **Add Credential**.
2. Give it a name that identifies the service and environment, such as `CRM test`.
3. Select **Credential Type** and fill in the fields below.
4. Save it, then select that credential in the HTTP tool, webhook, pre-call lookup, or MCP tool that should use it.
5. Test against an endpoint you control. Confirm the receiver accepted the authentication without printing its secret values.

| Type | Required fields | Request authentication |
| - | - | - |
| API Key | Header Name, API Key | Your chosen header, such as `X-API-Key` |
| Bearer Token | Token | Bearer authentication in `Authorization` |
| Basic Auth | Username, Password | HTTP Basic authentication |
| Custom Header | One or more header name/value rows | Every configured header is sent |
| None | No secret fields | No authentication from this credential |

For a service requiring two headers, use one **Custom Header** credential with both rows. Each header name must be unique, ignoring case; values must be single-line. Avoid duplicating an authentication header in both a credential and the tool's custom headers.

## Edit or rotate authentication

Open the credential's edit action. Stored secret values are not returned by credential listings. Leave authentication unchanged when changing only its name or description. Enable **Replace authentication details** when intentionally rotating the credential, enter the replacement details, and save.

Re-test every dependent integration after rotation. Before deleting a credential, replace its references in tools and workflow integrations; deleting it does not revoke the corresponding key at the external service.

## MCP sign-in credentials

For an external MCP server using OAuth, start **Sign in** from that MCP tool, complete the service's authorization flow, and wait for **Signed in**. The sign-in flow creates the OAuth credential; do not try to create one by pasting a token into the generic credential form. Follow [External MCP tools](/guides/mcp.md).

## Troubleshooting

An authentication failure can come from the wrong header name, token format, environment, external permissions, or an expired sign-in. Check the external receiver's response and the selected credential before changing the agent prompt. Keep authentication secrets out of prompts, model-generated parameters, and screenshots.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.