Skip to main content
Agents reach outside services using credentials stored in a vault. This guide connects one and verifies it resolves the way you expect.
1

Find the provider

2

Connect it

For an OAuth provider, this opens your browser:
On a machine without a browser, print the URL instead:
For an API-key provider, pass the key:
By default the credential lands in the vault for that workspace. To place it elsewhere — an org vault, so several teams can share it — name the vault:
Choosing where a credential lives is the main decision here. A workspace vault keeps it to one team. An org vault lets you share it — and then control who gets it with credential scope.
3

Confirm it works

This calls the provider for real, so it catches an expired or revoked token that a listing would still show as present.
4

Confirm agents will get the right one

This prints the tier-by-tier walk — personal, then workspace, then org — and shows what matched where.It matters because you can have more than one credential for a provider. If a personal credential shadows the shared team one, agents run as you rather than as the team, and the only place that’s visible is this walk.

​
Sharing a credential across teams

Put it in the org vault, then scope it:
Only an org owner or admin can scope org credentials. See Audit and scope org credentials.

​
GitHub needs a token for private repos

Signing in with GitHub grants public access only. To read private repositories — for skill sources or MCP repositories — connect a personal access token with the repo scope. See Connect GitHub for private repos.

​
Removing a connection

If several credentials exist for the provider, the command asks you to name one rather than guessing:

​
What agents see

A skill declares the services it requires. At run time, JoyStream resolves a credential for each and hands it to the MCP server in the environment variable that server expects. If a required credential is missing, the run stops and names the provider to connect — it does not guess. See Credentials and vaults for how the environment variable is chosen.

​
See also