> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-mcp-browser-pool-docs-pr112.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Credential Providers

> Connect external credential providers for managed auth

Use `manage_credential_providers` when your organization already stores login credentials in an external vault. Kernel can reference provider items during managed auth flows without storing the secret values directly in Kernel.

The current provider type is `onepassword`. After you create a provider, use `list_items` to find the provider-specific credential paths that can be passed to `manage_auth_connections`.

For 1Password setup and service-account requirements, see [1Password Integration](/integrations/1password).

## Actions

| Action       | Description                                                         |
| ------------ | ------------------------------------------------------------------- |
| `list`       | List configured providers.                                          |
| `get`        | Retrieve one provider by ID.                                        |
| `create`     | Configure a provider with a service-account token.                  |
| `update`     | Change provider name, token, priority, enabled state, or cache TTL. |
| `delete`     | Remove a provider.                                                  |
| `list_items` | List available credential items from the provider.                  |
| `test`       | Validate the provider token and list accessible vaults.             |

## Recommended flow

1. Call `create` with a service-account token for the provider.
2. Call `test` to confirm Kernel can access the vaults you expect.
3. Call `list_items` to discover credential item paths.
4. Use `credential_provider` with either `credential_path` or `credential_auto` when creating an auth connection.

## Parameters

| Parameter           | Description                                                                               |
| ------------------- | ----------------------------------------------------------------------------------------- |
| `action`            | Operation to perform. Required.                                                           |
| `id`                | Credential provider ID. Required for `get`, `update`, `delete`, `list_items`, and `test`. |
| `name`              | (create, update) Human-readable provider name. Must be unique per organization.           |
| `token`             | (create) Service-account token. (update) New token to rotate credentials.                 |
| `provider_type`     | (create) Provider type. Currently `onepassword`.                                          |
| `cache_ttl_seconds` | (create, update) How long to cache credential lists. Default 300.                         |
| `enabled`           | (update) Whether the provider is enabled for credential lookups.                          |
| `priority`          | (update) Priority order for credential lookups. Lower numbers are checked first.          |

## Create a 1Password provider

```json theme={null}
{
  "action": "create",
  "name": "engineering-1password",
  "provider_type": "onepassword",
  "token": "fake-1password-service-account-token",
  "cache_ttl_seconds": 300
}
```

## List provider items

```json theme={null}
{
  "action": "list_items",
  "id": "credprov_2vE4bN8xLmQ1pR6sT0Y3"
}
```