Skip to main content
A GroundForge credential is bound to a subject and restricted by Organization, Workspace, environment, and target. This is what lets one platform support people, Agents, automation, MCPs, and channel provider integrations, without ever needing to share one broad, all-purpose key.

​
External Agent credentials

For an external Agent:
  • create a dedicated Service Account;
  • scope it to one Workspace and environment;
  • set target kind GroundForgeExternalAgent;
  • set the target reference to the exact stable Agent ID.
A credential targeted to another Agent should never be able to register, discover, trace, claim, or complete work for this one. If you’re connecting several Agents, give each one its own credential.

​
Generated secrets

API-key secrets are shown once. Store them in a secret manager or a protected runtime environment right away. Never place them in source code, manifests, screenshots, shell history, prompts, tool inputs, or Trace metadata.

​
Write-only values

Model and integration secrets remain write-only in the UI and API. Updating a resource without supplying a replacement preserves the existing secret, so you never have to re-enter a working credential just to make an unrelated change. The CLI supports stdin for sensitive Agent model values:
Archive or revoke credentials as soon as they’re no longer required. See Security for the broader handling guidance. Related: Identity and access and Security.
Last modified on July 27, 2026

Related topics

Update CredentialGet CredentialDelete CredentialCreate Credential