Credentials

The credential vault stores encrypted secrets used by your APIs and tools for authenticated upstream requests. almyty encrypts all credential values at rest and never exposes raw secrets after creation.

Credentials vault

In the UI

Navigate to Settings in the sidebar, then open the Credentials tab
Click Add Credential

Add credential

Select a credential type (API Key, Bearer Token, Basic Auth, OAuth2, JWT, or Custom)
Enter a name and the required fields for that type
Click Save — the raw value is encrypted immediately and cannot be retrieved later
To use a credential, select it from the credential dropdown when configuring an API or tool

Access keys

The Access Keys tab manages keys for CLI and programmatic access to the almyty API itself (separate from gateway API keys).

Open the Access Keys tab
Click Create Access Key
Copy the key immediately — it is shown only once

Via the API

Create a credential


curl -X POST /credentials \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Stripe API Key",
    "type": "api_key",
    "value": "sk_live_...",
    "description": "Production Stripe key"
  }'

List credentials


curl /credentials \
  -H "Authorization: Bearer $TOKEN"

Values are never returned in list or detail responses.

Update a credential


curl -X PATCH /credentials/{id} \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "sk_live_new_..."
  }'

Delete a credential


curl -X DELETE /credentials/{id} \
  -H "Authorization: Bearer $TOKEN"

Supported types

Type	Fields	Use case
`api_key`	`value`	Third-party API keys (Stripe, Twilio, etc.)
`bearer_token`	`value`	Static bearer tokens
`basic_auth`	`username`, `password`	HTTP Basic Authentication
`oauth2`	`clientId`, `clientSecret`, `tokenUrl`, `scopes`	OAuth2 client credentials flow
`jwt`	`secret` or `privateKey`, `algorithm`	Signed JWT generation
`custom`	`headers` (key-value map)	Arbitrary headers or custom auth schemes

Configuration reference

Field	Type	Description
`name`	string	Display name for the credential
`type`	string	One of the supported types above
`value`	string	The secret value (encrypted at rest)
`description`	string	Optional description
`expiresAt`	string	Optional expiry date (ISO 8601)

Security

All values are encrypted with AES-256 using the server’s ENCRYPTION_KEY
Raw values are never returned by the API after creation
Credentials are scoped to the organization that created them
Deleting a credential does not affect historical request logs