---
title: "Credentials"
description: "credentials}"
canonical_url: "https://docs.superdurable.io/zh-Hans/reference/agents/credentials/"
source: "docs/reference/agents/credentials.mdx"
locale: "zh-Hans"
---

<a id="credentials"></a>

# Credentials

Keep model API keys and tool credentials in the Worker's environment or in a
secret store that the Worker reads when a call runs. Each framework reads its
model key from the environment, such as **OPENAI_API_KEY**, **GOOGLE_API_KEY**,
or **ANTHROPIC_API_KEY**. The adapters add no credential handling.

Never pass a credential in the session's start input, a user message, a tool
argument, a tool output, or an Attribute. Dex stores all of them in Flow
history and state:

- Dex Web shows them.
- History keeps superseded values for time travel.
- A stopped session stays readable for the retention period.
- Any authorized Client can read **AgentEvents**.

Session settings are part of the start input and of the session's state.
**get_agent_snapshot** and the browser snapshot JSON return them. So session
settings hold only references that the Worker resolves, such as a model name or
a credential name.

A Connector tool stores only the logical connection name with the call, as a
Connector Step does. The credentials stay with the Worker. See
[Connections](https://docs.superdurable.io/zh-Hans/reference/agents/connector-tools.md#connector-tools-connection).

For a credential that belongs to one user, let the tool look it up at call time
from a secret store, with a key that is not the secret itself. When a Flow of
your own must hold a short-lived secret, store it in a
[hard-delete Attribute](https://docs.superdurable.io/zh-Hans/concepts/primitives/attribute.md#hard-delete-attributes) and
delete it when the Flow no longer needs it.

Workers and Clients authenticate to Dex Server with bearer credentials. See
[authentication](https://docs.superdurable.io/zh-Hans/reference/server/authentication.md).