Security matters to me, so I want to understand how sensitive values are stored and used before I connect anything important. How are credentials and secrets handled, and how do I reference them in a workflow without exposing them? I’d also like to know what the recommended practices are. Any official documentation on this would be reassuring.
The short answer here is the credential proxy!
The credentials/secrets are not included anywhere inside the code within the step, and only injected into the outbound request when the step calls out! (and only injected into requests towards the specified endpoint the credential is configured to allow)
the AI cannot see the credential directly when building, and the credential is stored safely and encrypted on the backend.
When building and 3B needs a credential for a step it looks at the list of connectors is available and suggest which one it think fits but you can also guide it in the prompts to use a specific one. But it still never pull the credential into the step itself, it will still only be used via the credential proxy!