Skip to main content
Use manage_credentials when managed auth needs a username, password, or TOTP secret that Kernel can supply during login. Credential values are never returned by get; reads return metadata only. Store credentials here when you want Kernel to own the secret material. If your team already keeps secrets in an external vault, use Manage Credential Providers instead. For credential concepts and field types, see Credentials.

​
Actions

ActionDescription
listDiscover credentials, optionally filtered by domain.
getReturn credential metadata.
totp_codeReturn the current 6-digit TOTP code for credentials with a configured TOTP secret.
createStore a new credential.
updateRename a credential or merge new values.
deleteRemove a credential by ID or name.
  1. Call create with the domain, a stable name, and the credential fields.
  2. Use the credential name in manage_auth_connections when creating a managed login.
  3. Call totp_code only when the agent needs the current code for a manual step.
  4. Call update to rotate values or clear optional fields.

​
Parameters

ParameterDescription
actionOperation to perform. Required.
id_or_name(get, totp_code, update, delete) Credential ID or name.
domain(list) Filter by domain. (create) Target domain this credential is for.
name(create) Unique credential name. (update) New name.
values(create, update) Field name to value mapping, such as username and password. On update, values merge with existing values.
sso_provider(create, update) SSO provider, such as google, github, or microsoft. On update, an empty string clears it.
totp_secret(create, update) Base32-encoded TOTP secret for automatic 2FA. On update, an empty string clears it.
limit(list) Max results per page. Must be 1-100.
offset(list) Pagination offset. Must be 0 or greater.

​
Create a login credential

{
  "action": "create",
  "domain": "accounts.example.com",
  "name": "example-work-login",
  "values": {
    "username": "ops@example.com",
    "password": "fake-password-for-docs"
  },
  "totp_secret": "JBSWY3DPEHPK3PXP"
}

​
Get a TOTP code

{
  "action": "totp_code",
  "id_or_name": "example-work-login"
}