Credentials
Store the tokens, API keys and passwords that HTTP request and webhook steps, and AI agent tools, use to sign in to your own systems.
A credential is a secret your flows use to sign in to your own systems, such as a CRM or order system. You store it once under Automation › Credentials and then choose it by name in HTTP request and Send a webhook steps, and in AI agent tools. The secret never appears in the flow itself.
Note: Every role except Billing Administrator can see the list of credentials (never the secrets). Owners, Admins and Marketing Managers can store credentials and replace their secrets.
Kinds of credential
| Kind (How it signs in) | What is sent with each call |
|---|---|
| Bearer token | The token, as a bearer token. |
| API key header | The key, in a header you name (for example X-Api-Key). |
| Username and password | The username and password. |
Store a credential
- Go to Automation › Credentials.
- Click Store a credential.
- Enter a Name, so you can recognise it when choosing it in a step (up to 120 characters).
- Choose How it signs in.
- For API key header, enter the Header name: letters, digits and hyphens, starting with a letter or digit. For Username and password, enter the Username.
- Paste the secret into Token, Key or Password (up to 4,096 characters). Click Show secret to check it.
- Click Store credential.
The secret is sent once, stored encrypted and never shown again, here or anywhere else. Afterwards you see only its last four characters, or, for a password, nothing of it.
You can also store a credential from inside a step: in HTTP request or Send a webhook, set Sign in with to A stored credential, then click Store a new credential. It is chosen for that step at once, and your draft is not left.
The list
| Column | What it shows |
|---|---|
| Name | The credential's name. |
| Signs in with | The kind. |
| Secret | "Ends" and the last four characters, or "Password — never shown". |
| Set | When the secret was stored or last replaced. |
Replace a secret
When a token expires or you rotate a key:
- In the credential's row, choose Replace secret.
- Paste the new secret.
- Click Replace secret.
The new secret is used from the moment it is saved, and the old one stops working at once. Every step and tool that uses this credential picks up the new secret automatically.
Use a credential in a step
In HTTP request or Send a webhook:
- Set Sign in with to A stored credential.
- Under Credential, choose it. Each is listed by name and the last four characters of its secret.
Tip: Never put a secret in a step's Headers. Headers are stored in the flow in plain text and anyone who can view the flow can read them. Headers that carry sign-in details, such as Authorization or Cookie, are refused there: use a credential instead.
If a credential is missing or can't be used when a step runs, the step fails with Credential unavailable. In a test, the test run page shows which credential each simulated request would have signed in with.
Related
- Flow steps reference: the HTTP request and Send a webhook steps.
- Build an AI agent: tools use the same credentials.
- Inbound webhooks: for your system to call IconEngage instead.
Still need help?
Write to us at [email protected] and tell us what you were trying to do. Already a customer? Sign in to IconEngage — the same articles are under Help in the app.