Skip to main content

​
Credentials

Permission Slip stores your service credentials in an encrypted vault so agents can execute approved actions on your behalf — without ever seeing your credentials directly.

​
How Credential Storage Works

When you store a credential:
  1. You provide the service name, a label, and the credential values (e.g., an API key).
  2. Permission Slip encrypts the credential using AES-256-GCM and stores it in the vault.
  3. Only the metadata (service, label, date added) is visible in the UI — the secret value is never displayed again.
  4. At action execution time, Permission Slip decrypts the credential, passes it to the connector, and the connector uses it to authenticate with the external service.
Credentials are never logged, never included in API responses, and never exposed to agents. They are decrypted only at the moment of action execution.

​
Add a Credential

1

Open the connector detail page

Navigate to the agent’s config page, then click Configure on the connector.
2

Find the Credentials section

Each required credential type shows its service name, auth type, and current status — either Connected (green) or Not configured.
3

Click Connect

Fill in the credential details for the service. The required fields depend on the auth type (e.g., API key, OAuth token).
4

Save

The credential is encrypted and stored. The status changes to Connected.
Some connectors provide a How to get this credential link that takes you to the service’s documentation for generating API keys or tokens.

​
Manage Credentials

​
From the Connector Page

Each stored credential shows a delete button. Removing a credential means actions for that service can no longer be executed, even if approved.

​
From Settings

The Credential Vault section in Settings shows all credentials stored across all connectors:
  • Service name
  • Label and date added
  • Active status
This is a read-only view — credentials are added and removed from the connector configuration pages.

​
Multiple Credentials

You can store multiple credentials for the same service (e.g., different GitHub tokens for different repositories). Each one gets a unique label. When creating an action configuration, you can bind a specific credential to control which account is used.