Connection credentials and API keys
Create credentials through an approved Connection Profile or project connection screen. A credential carries the profile’s allowed scopes, identity mode and policy.
Safe credential practice
- Create one credential per client, automation or environment.
- Grant only required scopes such as chat, embeddings or product MCP.
- Use project-scoped credentials when a client should be limited to one project.
- Store credentials in your approved secret manager, never in source control, documentation or browser code.
- Rotate and revoke a credential when its owner, integration or environment changes.
Identity modes
A Connection Profile can use tenant machine-to-machine identity, user-delegated identity or a bound actor. The Connect information in the product is the authoritative source for the supported mode and exact endpoint for that profile.