Credentials
Store, rotate, and revoke the API keys and tokens your agents use to authenticate calls to your own systems.
When an agent calls one of your systems — an HTTP tool, a webhook — it usually has to authenticate. A credential holds those secrets once, so you configure them in one place instead of pasting a key into every tool.
Creating one
Credentials are created where they're used: in a tool's Authentication picker, click the + button. Choose a type, fill in its fields, and the new credential is selected for that tool.
| Type | Sends |
|---|---|
| Bearer Token | Authorization: Bearer <token> |
| API Key | A header you name, carrying the key |
| Basic Auth | Authorization: Basic <base64 of username:password> |
| Custom Header | A header name and value you specify |
Managing them
Settings → Credentials lists every credential in your organization, with its type, description, and when it was last changed.
Rotating a secret
Click the pencil, enter the new secret, and save. Stored secrets are never displayed — the fields show as empty, and leaving them empty keeps the current value. To replace a secret you must fill in every field for that credential type: the stored value is replaced wholesale, so a partial change would blank the fields you left empty. Talkr won't submit a partial change.
Rotating takes effect immediately for every tool using that credential; there's no republish step.
Renaming
The same dialog changes the name and description. Leave the secret fields blank and only the labels change.
Deleting
Click the bin. Talkr checks what still points at the credential before removing it, and if anything does, it tells you exactly what — by name — instead of deleting it and letting the breakage surface on a live call.
Both your tools and your agents are checked, including the published version of an agent rather than only the draft you last edited.
If you need it gone regardless — a leaked key is worth breaking an agent over — press Delete anyway. That's recorded in your audit log along with the list of what it broke, so the tool failures that follow have an explanation. Deleting can't be undone.
Rotating is usually what you want instead. Replacing the secret on an existing credential keeps every tool and agent pointing at it and takes effect immediately — no edits, and nothing breaks.
Creating, editing, and deleting credentials requires the manage_credentials permission. Owners and Admins have it by default. Every change is recorded in your Audit Log — the credential's name and type, never its secret value.
What's not here
Connector credentials — Salesforce, HubSpot, Zendesk and the rest — are managed on the Connectors page instead, because they're established through each provider's OAuth flow rather than by pasting a key.
Provider API keys for your LLM, speech-to-text, and text-to-speech run through Inference Providers.