> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guild.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1.
> The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml).
> Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer <api_key_id>:<api_key_secret>`. See https://docs.guild.ai/api-reference/introduction#authentication.
> To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers.
> To act on Guild from an MCP client, connect to https://api.guild.ai/mcp (OAuth) or run `guild mcp` locally. Setup: https://docs.guild.ai/api-reference/mcp.
> To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt.

# Workspace credentials

> See which credentials agents in a Guild workspace can use, connect workspace or member credentials, and bind a credential to an agent.

The **Credentials** page shows which credentials agents in a workspace can use, and which identity each installed agent runs as. Open the workspace and click **Credentials** under **Setup**. See [Credentials](https://docs.guild.ai/platform/credentials.md) for the ownership model and the order Guild resolves credentials in.

## Credentials available here

The first table lists every credential agents here can reach, one row per credential. Each row gives the **Integration**, who it was **Added by**, its **Scope**, a **Policy** chip, and when it was **Connected at**.

| Scope | Where the credential comes from |
| - | - |
| **Account default** | The owning account's shared pool, available to all its workspaces |
| **Workspace** | Homed to this workspace, and offered to no other |
| **Member · *name*** | That member's own credential, serving only their runs. Your own reads **Member · you** |
| **Agent** | Granted or dedicated to one installed agent |

The **Policy** chip summarizes the credential's [policies](https://docs.guild.ai/platform/credential-policies.md) and opens them: **No restrictions**, a count such as **1 policy**, or the allowed methods when that is all a single policy permits, such as **GET, OPTIONS only**.

**Manage credentials** opens the account's [credential settings](https://docs.guild.ai/platform/credentials.md#managing-credentials). It's shown to organization admins and to the owner of a personal account.

### Connect a credential

Click **Connect credential**. Admins and organization members both see it.

1. Under **Who does this credential belong to?**, choose **The whole workspace** for a workspace credential or **Only me** for a member credential. The choice appears only when you can connect both. Members who aren't admins can connect only their own.
2. Pick the **Integration**. The list includes integrations available to this workspace that connect with an API key or an OAuth sign-in.
3. Click **Connect**, or **Continue to integration** to sign in with the provider.

### Disconnect a credential

**Disconnect** appears on the rows you're allowed to remove: credentials you own, your own member credentials, and, for organization admins, any member credential or credential the workspace's account owns. A warning appears if active webhook triggers depend on the credential.

> [!WARNING]
>
> Disconnecting deletes the credential, not just its use in this workspace. Disconnecting an **Account default** row removes that credential from every workspace in the account.

To remove a credential from one agent, revoke it in the agent's credentials instead. See [Grant and revoke credentials](#grant-and-revoke-credentials).

## Which identity each agent will use

The second table, **Bind a credential to an agent in this workspace**, lists the installed agents with their **Version**, **Binding**, and when they were **Added**. A binding is a credential granted or dedicated to that agent, so the column answers whether the agent has one of its own and whose login it runs as. It doesn't say which credential a call resolves to when the agent has none.

| Binding | Meaning |
| - | - |
| ***app*: Granted · *owner*** | An existing credential shared with this agent, running as *owner* |
| ***app*: Dedicated** | A credential that exists only for this agent |
| **Organization pool (no binding)** | Nothing bound, so the agent falls through to member, workspace, and account credentials |
| **None bound for *your name*. Grant or connect each integration this agent calls.** | Nothing bound, and this workspace bars the account pool, so a call fails unless your member credential or a workspace credential covers it |

An agent bound for several apps lists one per line. If an agent holds more bindings than the page reads at once, a last line says **Showing the first *count* credentials.** Click **Add Agent** to install another agent in the workspace, or select a row to open the agent's [detail page](https://docs.guild.ai/platform/workspace-agents.md#agent-detail-page).

A grant runs as the credential's owner, and a task runs as the person who started it, so a grant of another member's credential won't resolve for your runs. Bind the agent with your own credential, or with one the organization owns, if it needs to work for everyone.

### Grant and revoke credentials

Click **Grant** or **Revoke** on an agent's row. Both open the same **Credentials for *agent*** dialog.

The credentials are listed in two groups:

* **Granted to this agent** — existing credentials shared with the agent, each marked **Granted · *owner***. Pick one from **Search credentials…** and click **Grant credential** to add it. A grant runs as the credential's owner.
* **Dedicated to this agent** — credentials that exist only for this agent, marked **Dedicated**. Click **Connect a credential**, choose the integration, then **Connect API key** or **Connect via OAuth**. If the agent already has a dedicated credential for that integration, connecting a new one replaces it and deletes the old one.

Each row has a **Policy** chip and a **Policies** link that open the credential's [policies](https://docs.guild.ai/platform/credential-policies.md). Click **Revoke grant** to remove a credential from the agent, then confirm. When two rows are for the same integration, an **ID** chip tells them apart.

Only the person who added the agent to this workspace, the owner of a personal account, or an organization admin can change these credentials. Everyone else sees them read-only.

## Restricting the account pool

Turn on **Use only credentials scoped to this workspace** to stop agents here from falling back to the owning account's shared credentials. Agents then use only workspace, member, or agent credentials. The change saves as soon as you flip the toggle.

The toggle appears on both the workspace's **Credentials** and **Settings** pages. Connect or bind what the workspace needs before you turn it on. See [Restrict a workspace to its own credentials](https://docs.guild.ai/platform/credentials.md#restrict-a-workspace-to-its-own-credentials).

## Related pages

* [Credentials](https://docs.guild.ai/platform/credentials.md) for how Guild chooses a credential
* [Credential policies](https://docs.guild.ai/platform/credential-policies.md) for restricting what a credential can do
* [Workspace agents](https://docs.guild.ai/platform/workspace-agents.md) for the same bindings on each agent's page