How to Manage Credentials

Credentials are securely stored authentication details that your agents and connectors use to access external services like databases, APIs, and SaaS tools. All credentials are encrypted with AES-256.

Viewing Your Credentials

Navigate to Settings > Credentials from the sidebar.

Each credential card shows:

• Profile Name — The name you gave this credential set
• Type Badge — Either MCP (for connectors) or Plugin (for tools)
• Resource ID — The linked MCP server or plugin
• Created / Last Updated dates
• Edit and Delete buttons

Use the search bar to find credentials by name, and the filter dropdown to show only MCP, Tool, or General credentials.

Creating a Credential

For MCP Connectors (e.g., PostgreSQL, Gmail, Stripe)

1. Click + Add Credential (top right)
2. In the modal, change Resource Type from "General" to MCP
3. In the Select Resource field, search for your MCP (e.g., type "PostgreSQL")
4. Click on the matching result in the dropdown
5. The form will dynamically load the credential fields required by that MCP
6. Fill in all required fields:
   • For PostgreSQL: host, port, database, username, password
   • For Gmail: OAuth flow (click authorize)
   • For Stripe: API key
   • For Discord: bot token, guild ID
7. Set a Profile Name (auto-generated from the resource name, editable)
8. Choose Access Scope:
   • Personal — Only you can use this credential
   • Team — Your team members can use it
   • Organization — Everyone in your org can use it
9. Click Save

For General Credentials (API keys, tokens)

1. Click + Add Credential
2. Keep Resource Type as General
3. Enter a Field Name (e.g., api_key, access_token)
4. Enter the Value (the actual secret)
5. Set a Profile Name
6. Click Save

Credential Scopes

Credentials follow a priority system when multiple credentials exist with the same profile name:

When your agent uses a tool, Kaman automatically picks the highest-priority credential available.

Editing a Credential

1. Find the credential card
2. Click Edit
3. Update the values
4. Click Save

Note: Existing credential values are decrypted and pre-filled when editing.

Deleting a Credential

1. Find the credential card
2. Click Delete
3. Type DELETE in the confirmation input
4. Click confirm

Warning: Deleting a credential will break any connectors or tools that depend on it. Make sure nothing is using it first.

OAuth Credentials (Google, Microsoft, Salesforce)

For OAuth-based services:

1. Select the MCP resource (e.g., "Google")
2. Click the Authorize button that appears
3. A browser popup will open for the OAuth consent screen
4. Sign in and grant permissions
5. The tokens are automatically stored and encrypted
6. Token refresh happens automatically when tokens expire

Security

• All credential values are encrypted with AES-256 before storage
• Credentials are never returned in plaintext via API responses
• Credentials are never visible in logs
• Each credential is scoped to a user, team, or organization
• Cross-organization access is impossible — credentials are isolated per client