Skip to content

Manage integration credentials

Use Settings → Credentials to save keys and login details for external services. You can then select them in multiple tools or lookups. You need permission to manage credentials.

These credentials belong to external services. Create keys for an application accessing Nuvoca separately under API access.

Choose the authentication type

Type Use when Configure
API key The service provides a fixed key or token Name and secret value. Select the required header and prefix in the integration.
Basic Auth The service expects HTTP Basic authentication Username, password and allowed resource URL.
HTTP Login A login request returns a token Login request, token extraction, validity and optional refresh request.
OAuth The service uses an OAuth grant Follow OAuth setup.

Use the method documented by the external service. An API key does not belong in OAuth client ID and client secret fields.

For a stored API key, the prefix is placed exactly before the key. For a Bearer header, enter Bearer with a trailing space; leave it empty to send the key alone. Nuvoca adds no separators. Check all usages after changing the credential.

Configure HTTP Login

  1. Enter the login URL and supported request method and format.
  2. Configure login fields, headers or body template. Mark secret values appropriately.
  3. Set the path to the returned access token.
  4. Configure expiry handling from the response or the supported lifetime settings.
  5. If required, configure the refresh token path and refresh request.
  6. Set the resource URL, token header and prefix expected by the target API.
  7. Test authentication, then test a request to the actual resource.

If the login response contains {"access_token":"example-token","expires_in":3600}, select the access token and expiry fields in the editor.

Use and rotate a credential

Select the credential in the API tool, MCP connection or processing editor where that authentication type is supported. Check the destination URL and authentication header. Avoid adding a second conflicting Authorization header manually.

When a key changes, update the saved credential and test the connected tools. Before deleting a credential, review its usages and select a replacement in those integrations.

Troubleshoot authentication

If authentication fails, check the destination URL, authentication method and account permissions. Also check whether the token has expired and whether the header prefix matches the API. Remove secret values from screenshots before sending them to support.