> ## Documentation Index
> Fetch the complete documentation index at: https://docs.groundforge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Issue narrowly scoped credentials and handle secrets safely.

A GroundForge credential is bound to a subject and restricted by Organization, Workspace, environment, and target. This is what lets one platform support people, Agents, automation, MCPs, and channel provider integrations, without ever needing to share one broad, all-purpose key.

## External Agent credentials

For an external Agent:

* create a dedicated Service Account;
* scope it to one Workspace and environment;
* set target kind `GroundForgeExternalAgent`;
* set the target reference to the exact stable Agent ID.

A credential targeted to another Agent should never be able to register, discover, trace, claim, or complete work for this one. If you're connecting several Agents, give each one its own credential.

## Generated secrets

API-key secrets are shown once. Store them in a secret manager or a protected runtime environment right away. Never place them in source code, manifests, screenshots, shell history, prompts, tool inputs, or Trace metadata.

## Write-only values

Model and integration secrets remain write-only in the UI and API. Updating a resource without supplying a replacement preserves the existing secret, so you never have to re-enter a working credential just to make an unrelated change.

The CLI supports stdin for sensitive Agent model values:

```bash theme={null}
printf '%s' "$MODEL_API_KEY" | \
  gforge agents update <agent-id> --model-credential-stdin
```

Archive or revoke credentials as soon as they're no longer required. See [Security](/help/security) for the broader handling guidance.

Related: [Identity and access](/concepts/identity) and [Security](/help/security).


## Related topics

- [Update Credential](/api-reference/endpoints/update-credential.md)
- [Get Credential](/api-reference/endpoints/get-credential.md)
- [Delete Credential](/api-reference/endpoints/delete-credential.md)
- [Create Credential](/api-reference/endpoints/create-credential.md)