Inbound credentials with an agent

One registered tool set covers both credential types. Set credentialType to proxy for an inbound credential. Secrets are redacted unless get_credential is explicitly called with include_secrets: true.

Call get_guide with guide_key: "credential-creation" before the first create.

Call order

1. Call create_credential.
   • Required: clientId, credentialName, credentialType, credentialAuthType, credentialRegion, credentialSecret.
   • Optional: credentialNotes, pendingFields.
2. Keep the returned credential sKey.
3. Attach it to a proxy or direct MCP server in the same region.

Use list_credentials(clientId) to discover ids. get_credential requires clientId and credentialId; include_secrets is optional. update_credential requires those same ids and accepts only optional credentialName and credentialNotes. Secret rotation requires a new credential.

Example

{
  "tool": "create_credential",
  "arguments": {
    "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
    "credentialName": "Caller key",
    "credentialType": "proxy",
    "credentialAuthType": "key",
    "credentialRegion": "us-east-2",
    "credentialSecret": {
      "key": "Authorization",
      "value": "replace-me",
      "addToHeader": true
    }
  }
}

The result returns the credential without exposing its secret.

Rules and filters can also hang off a credential. Those tools are on the matching Control and Govern pages.

Next