# What are credentials in Tines and how should I manage them securely?

**URL:** <https://community.tines.com/t/what-are-credentials-in-tines-and-how-should-i-manage-them-securely/87>\
**Category:** Tines Stories: Ask + Answer\
**Created:** [June 30, 2026, 6:00pm UTC](https://community.tines.com/t/what-are-credentials-in-tines-and-how-should-i-manage-them-securely/87 "2026-06-30T18:00:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sapling](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/sapling/32/36_2.png) [@sapling](https://community.tines.com/u/sapling)\
**Post date:** [June 30, 2026, 6:00pm UTC](https://community.tines.com/t/what-are-credentials-in-tines-and-how-should-i-manage-them-securely/87/1 "2026-06-30T18:00:01Z")

</div>

I want to make sure I’m handling API keys and secrets in Tines the right way. I’ve been storing them as credentials but I’m not totally clear on best practices around naming, scoping, rotation, or access control. What do experienced Tines users do to keep credentials well-organised and secure?

---

<div class="post-metadata">

**Author:** ![Angie](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/angie/32/44_2.png) [@Angie](https://community.tines.com/u/Angie)\
**Post date:** [July 10, 2026, 8:55pm UTC](https://community.tines.com/t/what-are-credentials-in-tines-and-how-should-i-manage-them-securely/87/2 "2026-07-10T20:55:37Z")

</div>

Credentials in Tines are the secure storage mechanism for secrets like API keys, tokens, passwords, and OAuth client credentials.

When you reference a credential in a story using a formula like `CREDENTIAL.virustotal_api_key`, Tines substitutes the value in at runtime without ever exposing it in the action configuration, the story itself, or to other users.

It’s also worth knowing Tines supports several credential types beyond plain text, so you can match the auth style of whatever you’re connecting to:

- **Text** for simple API keys and tokens
- **OAuth 2.0** (which handles token refresh for you)
- **JWT** , **AWS** , **HTTP Request** , **Mutual TLS** , and **Multi Request** for more specific auth flows

There are also product-specific [connect flows](https://www.tines.com/docs/credentials/connect-flows/) that walk you through credential setup for common tools.

On the management side, here’s what experienced users tend to do:

- **Naming.** Use clear, consistent names that make the service and environment obvious at a glance, for example `virustotal_api_key_prod`.
- **Scoping.** Credentials live at the team level, so scope them to the teams that actually need them rather than spreading everything everywhere.
- **Rotation.** Rotate on a defined schedule. The nice part is that you update the credential once, centrally, and every story referencing it by name automatically picks up the new value.
- **Store config alongside the secret.** Credentials support non-secret metadata, which you can reference with `INFO.credential.<name>.metadata.<key>`. It’s handy for keeping environment-specific config like base URLs or tenant IDs in the same place as the secret.

For deeper reading, the [Tines credentials docs](https://www.tines.com/docs/credentials) cover every credential type and configuration in detail, the [Authentication Guides](https://explained.tines.com/en/collections/3801629-authentication-guides) have step-by-step setup for common products, and [Tines University](https://www.tines.com/university) covers credential management as part of its security best practices material.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/system/32/232_2.png) [@system](https://community.tines.com/u/system)\
**Post date:** [July 13, 2026, 9:04am UTC](https://community.tines.com/t/what-are-credentials-in-tines-and-how-should-i-manage-them-securely/87/3 "2026-07-13T09:04:17Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.