Credentials overview
Credentials store secrets for tool authentication — API keys, Bearer tokens, OAuth tokens, and HMAC signing keys. Values are encrypted at rest, injected only at tool execution time, and never shown to visitors or embedded in the widget.
Supported auth types
Section titled “Supported auth types”| Type | Use case |
|---|---|
| Bearer token | Authorization: Bearer … |
| API key | Custom header or query parameter |
| OAuth 2.0 | Authorization code or client credentials |
| HMAC | Signed requests to your API |
How credentials flow
Section titled “How credentials flow”- Admin creates a credential in Credentials.
- API Request or MCP tools reference it.
- Visitor chats; model triggers a tool call.
- Chatevo adds auth headers/signatures server-side and calls your API.
The LLM sees tool parameters, not secrets.
Create a credential
Section titled “Create a credential”- Go to Credentials → Create.
- Choose auth type.
- Enter secret values and any type-specific settings (OAuth URLs, HMAC algorithm, header names).
- Save — secrets are masked after save.
- Attach to tools under Attach credentials.
Rotation and environments
Section titled “Rotation and environments”| Practice | Detail |
|---|---|
| Separate credentials | Development, staging, production APIs |
| Rotation | Update credential; linked tools use new value immediately |
| Least privilege | Scoped API keys per tool group |
Pair credentials with deployment environments.
Security
Section titled “Security”- Encryption details: Encryption at rest
- Webhook signing uses separate HMAC config — see Outbound webhooks