> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-mcp-browser-pool-docs-pr112.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Credentials

> Store and manage credentials for Kernel managed auth

Use `manage_credentials` when managed auth needs a username, password, or TOTP secret that Kernel can supply during login. Credential values are never returned by `get`; reads return metadata only.

Store credentials here when you want Kernel to own the secret material. If your team already keeps secrets in an external vault, use [Manage Credential Providers](/reference/mcp-server/tools/manage-credential-providers) instead.

For credential concepts and field types, see [Credentials](/auth/credentials).

## Actions

| Action      | Description                                                                         |
| ----------- | ----------------------------------------------------------------------------------- |
| `list`      | Discover credentials, optionally filtered by domain.                                |
| `get`       | Return credential metadata.                                                         |
| `totp_code` | Return the current 6-digit TOTP code for credentials with a configured TOTP secret. |
| `create`    | Store a new credential.                                                             |
| `update`    | Rename a credential or merge new values.                                            |
| `delete`    | Remove a credential by ID or name.                                                  |

## Recommended flow

1. Call `create` with the domain, a stable name, and the credential fields.
2. Use the credential name in `manage_auth_connections` when creating a managed login.
3. Call `totp_code` only when the agent needs the current code for a manual step.
4. Call `update` to rotate values or clear optional fields.

## Parameters

| Parameter      | Description                                                                                                                    |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `action`       | Operation to perform. Required.                                                                                                |
| `id_or_name`   | (get, totp\_code, update, delete) Credential ID or name.                                                                       |
| `domain`       | (list) Filter by domain. (create) Target domain this credential is for.                                                        |
| `name`         | (create) Unique credential name. (update) New name.                                                                            |
| `values`       | (create, update) Field name to value mapping, such as `username` and `password`. On update, values merge with existing values. |
| `sso_provider` | (create, update) SSO provider, such as `google`, `github`, or `microsoft`. On update, an empty string clears it.               |
| `totp_secret`  | (create, update) Base32-encoded TOTP secret for automatic 2FA. On update, an empty string clears it.                           |
| `limit`        | (list) Max results per page. Must be 1-100.                                                                                    |
| `offset`       | (list) Pagination offset. Must be 0 or greater.                                                                                |

## Create a login credential

```json theme={null}
{
  "action": "create",
  "domain": "accounts.example.com",
  "name": "example-work-login",
  "values": {
    "username": "ops@example.com",
    "password": "fake-password-for-docs"
  },
  "totp_secret": "JBSWY3DPEHPK3PXP"
}
```

## Get a TOTP code

```json theme={null}
{
  "action": "totp_code",
  "id_or_name": "example-work-login"
}
```