Saved credentials
Store API keys, OAuth tokens, and webhook secrets once — reuse them across any automation node without re-entering them.
The credentials vault lets you store API keys, OAuth tokens, and webhook secrets at the workspace level. Once saved, any automation node that requires a key can reference it by name — you never need to paste the same token into dozens of nodes.
---
Go to Settings → Credentials (or /workspace/credentials):
- Add — enter a name, type, and value (the raw key or token)
- Edit — update the name or rotate the value
- Delete — permanently removes the credential; automations that reference it will fail until updated
Credential values are encrypted at rest and never returned in full after saving — you only see the last 4 characters to confirm which key is saved.
---
| Type | Used by |
|---|---|
| API key | Any node that calls an external service (Slack, Twilio, OpenAI, etc.) |
| OAuth token | GoHighLevel, HubSpot, Pipedrive, Google Sheets — generated via the OAuth connect flow |
| Webhook secret | Outbound webhook nodes — sent as HMAC-signed headers |
| SMTP password | Mailbox connection (alternative to the mailbox connect wizard) |
| Bearer token | Generic HTTP header for custom integrations |
---
- Open the automation builder
- Select a node that accepts a credential (e.g. Slack, GoHighLevel, Google Sheets)
- In the config panel, the Credential field shows a dropdown of all saved credentials of the matching type
- Select the saved credential — the actual value is never shown on the canvas
---
GoHighLevel, HubSpot, Pipedrive, and Google integrations use OAuth rather than raw API keys. To connect:
- Go to Settings → Credentials → Connect [service]
- Complete the OAuth flow in the popup window
- The token is automatically saved as a credential named
[service] — [your email] - Select it in any compatible node
OAuth tokens auto-refresh in the background — you never need to reconnect unless you revoke access on the provider's side.
---
- Credentials are encrypted with AES-256 before storage
- Values are never logged, never included in error messages, and never returned via the API
- Deleting a credential is permanent and cannot be undone
- Admin users can see credential names and types (not values) workspace-wide