Skip to main content
Credentials let agents access external services like GitHub, Slack, and Jira on behalf of your team. They are configured at the organization level and shared across all workspaces.

​
Connecting a service

Connecting and disconnecting credentials for organization-owned integrations requires the Admin role. Members without it see each integration’s connection status but no Connect or Disconnect action. Credentials that are not organization-owned are unaffected.One exception: installing a workspace agent that needs its own dedicated credential lets the installer mint that agent’s key without being an admin.
  1. Go to your organization at app.guild.ai
  2. Open Settings > Credentials
  3. Click Connect next to the service you want to add
  4. Complete the OAuth flow to authorize Guild

​
Supported services

Guild supports credentials for every service in the integrations catalog, covering code hosting, CI/CD, communication, project management, observability, and data services. You can also create custom integrations with their own credentials.

​
How agents use credentials

Agents never see credentials. When an agent calls a service tool (e.g. github_issues_get), the request is routed through Guild’s credential proxy, which checks the credential policies for that credential, agent, and workspace, then injects authentication server-side. The credential never enters the agent’s code, container, prompt, or state. For GitHub, Guild authenticates as a GitHub App and mints short-lived installation access tokens on demand. No long-lived GitHub token is stored in or distributed to any runtime, and access is bounded by the repositories the App is installed on — enforced by GitHub itself, in addition to Guild’s policy layer. LLM provider keys follow the same model: they are held server-side and never placed in the agent runtime. See LLM settings. If an agent needs a credential that hasn’t been connected, it can request one using guild_credentials_request from guildTools:
The user is prompted to connect the service before the agent continues.

​
Managing credentials

Credentials can be disconnected and reconnected at any time from Settings > Credentials. Disconnecting a credential immediately blocks agent access to that service: because credentials are resolved at the proxy on every request, subsequent tool calls are denied — including calls from sessions that are already running. For organization-owned integrations, only admins can disconnect or reconnect.

​
Find credentials with the command palette

Open the command palette with Cmd+K / Ctrl+K and search the credentials scope for a third-party service by name. Selecting a service you have not connected opens Settings > Credentials filtered to it, with its Connect button. LLM Settings (next in the Settings sidebar) configures LLM providers and API keys separately from service credentials. See LLM settings.