> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tala-assistant.com/llms.txt
> Use this file to discover all available pages before exploring further.

# External Credentials

> Securely store API keys and tokens for use in webhooks and custom tools

## Overview

External credentials are stored secrets that Tala uses to authenticate outgoing webhook requests and custom HTTP tools. Once stored, a credential can be referenced by name and applied server-side without exposing its secret value in workflow definitions.

<Note>
  Credential support is available at the platform level. Editor integrations are still rolling out, so the credential picker may not appear in every screen yet.
</Note>

## Credential Types

| Type              | Header Sent                              | Example Use Case                          |
| ----------------- | ---------------------------------------- | ----------------------------------------- |
| **API Key**       | `X-API-Key: your-key`                    | REST APIs that use an API key header      |
| **Bearer Token**  | `Authorization: Bearer your-token`       | OAuth2 APIs, JWT-based services           |
| **Basic Auth**    | `Authorization: Basic base64(user:pass)` | Legacy APIs with username/password        |
| **Custom Header** | `Your-Header: your-value`                | Services with non-standard authentication |

## Managing Credentials

Tala supports creating, updating, listing, and deleting stored credentials for your organization. The management surface may vary depending on the feature rollout in your workspace.

Each credential includes:

* A display name
* An optional description
* A credential type
* The secret data required for that type

<Note>
  Updating a credential immediately applies to all webhooks and custom tools that reference it. No redeployment is needed.
</Note>

<Warning>
  Deleting a credential will break any webhook or custom tool that references it. Make sure no active integrations depend on the credential before deleting.
</Warning>

## Security

* **Encrypted at rest** -- credential values are encrypted before being stored in the database
* **Metadata-only responses** -- Tala returns credential metadata such as name and type, but not the stored secret value
* **Server-side usage** -- auth headers are constructed by Tala when a feature references the credential
* **Organization-scoped** -- credentials are shared across your organization and accessible to all members

## Using Credentials

Credentials are referenced when configuring:

* **[Webhook nodes](/features/webhooks)** -- webhook requests can include credential-backed authentication when that editor surface is available in your workspace
* **[Custom HTTP tools](/workflows/tools)** -- tools can use stored credentials through advanced or API-backed configuration