Core concept: Credentials
Credentials are encrypted secrets your tools use to authenticate with external APIs and MCP servers. Visitors and the LLM never see raw keys — Chatevo injects them server-side at call time.
Why credentials exist
Section titled “Why credentials exist”Tools call your order system, CRM, or booking API on behalf of the assistant. Those endpoints require API keys, bearer tokens, OAuth tokens, or HMAC signatures. Storing them in Chatevo keeps secrets out of prompts, embed code, and browser traffic.
Supported auth types
Section titled “Supported auth types”| Type | Use when |
|---|---|
| API key | Static key in header or query |
| Bearer token | Authorization: Bearer … |
| OAuth 2.0 | Short-lived tokens with refresh |
| HMAC | Signed requests to partner APIs |
Setup guides: API key · Bearer · OAuth 2.0 · HMAC
How tools reference credentials
Section titled “How tools reference credentials”When you create an API Request or MCP tool, you link one credential record. At execution time the Query Strategist selects the tool; Chatevo’s backend attaches the decrypted secret and calls your endpoint.
Failed auth (401/403) surfaces in execution logs — see Troubleshooting tool 401.
Security model
Section titled “Security model”- TLS in transit for all API and widget traffic
- Encryption at rest for credential payloads in PostgreSQL
- Organization isolation — credentials belong to one tenant
- Role gating — only admins and editors create or rotate credentials; viewers cannot
See Encryption and Data handling.
Rotation best practices
Section titled “Rotation best practices”- Create a new credential with the updated secret.
- Update tools to reference the new credential.
- Test in the assistant preview.
- Revoke the old credential in your upstream system, then delete the old record in Chatevo.