> ## Documentation Index
> Fetch the complete documentation index at: https://help.teable.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials and Integrations

> Manage your connections and secrets, and grant them to the apps and automations that need them.

<Note>Available on all Cloud plans; Self-Hosted requires Business or higher.</Note>

When an app or an automation calls an external service, it uses **your credential**. Credentials belong to you, not to the app or automation, and come in two kinds:

* **Connections**: third-party accounts you authorize to Teable, such as Slack, Airtable, or Google Sheets.
* **Secrets**: strings you store yourself, such as an API key or an access token.

You manage credentials in **Settings** → **Integrations** and grant them to individual apps and automations. Once granted, everyone who runs that app or automation uses the granting person's credential. The value is never shown to anyone, and automation test results mask it.

## Manage Your Connections and Secrets

Click your avatar in the lower left, then open **Settings** → **Integrations**. The page has three sections: **My connections**, **My secrets**, and **Third-party apps you authorized**.

**Add secret** asks for:

| Field | Description |
| - | - |
| **Key** | Starts with an uppercase letter; uppercase letters, digits, and underscores only |
| **Value** | Write-only after saving; enter a new value to replace it |
| **Description** | Optional, to record what the secret is for |

Add a connection with **Connect new account**. Type a service name in the search box: the services Teable integrates itself are pinned at the top, and the **Managed by Composio** group below holds several hundred more that Composio authorizes. Both kinds are granted to apps and automations the same way, and neither exposes its value; they differ only in how app code reads them, covered under "Read a Credential in Code" below.

Most services take a single OAuth round trip. A service marked **Connects with an API key** opens a connect dialog instead and asks for the key that service issued you; Composio keeps that value and signs each request with it, and Teable never stores it.

When an authorization expires, the connection offers **Reconnect**.

Each credential shows how many resources currently use it. Click **View** for the list of apps and automations, each marked with when the grant was made, where you can **Remove grant** for any single one.

## Grant a Credential to an App or Automation

Open the resource's credential panel:

* **Apps**: in the App Builder chat panel, open **+** → **More** → **Credentials & config**.
* **Automations**: open the workflow and click **Credentials & config** on the **Edit** tab.

**Grant** offers three routes: **Grant existing credential** picks one of your secrets or connections; **Add secret** creates one and grants it right away; or pick a third-party service from the **Services** list, which runs an OAuth flow for a service you have not connected and grants directly for one marked **Connected**.

Every grant needs a **Variable name**, the alias this credential has inside that app or automation. It follows the same naming rules as a secret key, and it is the name the code reads.

The panel can also list **Not bound yet** placeholders. Copying an app, duplicating a workflow, and importing or duplicating a project carry over the aliases the code expects but none of the credentials. Click **Bind mine** to supply your own credential so the app or automation can run.

When an alias currently holds someone else's credential, **Replace with mine** takes it over. **Only remove the grant (keep placeholder)** unbinds it and leaves the placeholder, so the code needs no change.

When a project still has integrations that are not connected, a strip at the top of the page reads **N integrations are not connected.** Click **Connect** to open the integrations panel and connect an account or enter a key row by row. Closing the strip only silences the integrations that are empty right now; it comes back when a new one is left open. The panel only connects and authorizes — whether an automation runs is still decided by its own switch.

<Info>Editing a resource's credential grants requires edit permission on that app or automation. You can only grant credentials you own.</Info>

## Read a Credential in Code

| Where | How to read it |
| - | - |
| Automation scripts | An environment variable, such as `process.env.EXTERNAL_API_KEY` |
| Automation input fields | Click **Insert secret** beside the field and pick a granted secret |
| Secrets in an app | Server-side code reads `process.env.MY_API_KEY` |
| Connections in an app | Server-side code calls `getConnectionToken('ALIAS')` for an access token |
| Composio-managed connections in an app | These have no access token to exchange; server-side code calls `callConnection('ALIAS', { ... })` instead, and Composio signs the request server-side |

Paste something that looks like a key into an automation input field and Teable stores it as your secret, leaving a reference in place, so the plaintext never lands in the workflow configuration. Click **Undo** in the notice if you would rather keep the text as typed.

## Credits for Third-Party App Calls

Calling a third-party app through a connection consumes the space's credits, whether the call comes from AI chat, an app, or an automation. These charges are listed under type **Third-party apps** in **Credit usage summary** on the billing page.

Most apps cost very little per call. Apps that bill Teable per returned resource or per request, such as X, cost noticeably more for a single call. Failed calls are not charged, and neither is looking up available tools. Once the space runs out of credits, these calls are refused.

## Authorization Cards in AI Chat

When AI needs an external account, it pins a card headed **Authorization required for this task** to the conversation and waits for you before the turn goes on. Which card you get depends on who needs the credential.

**Connect card**: appears when Cuppy itself has to read or write a service to finish the task, such as fetching mail from Gmail or writing to Notion. The card names the service; click **Connect** to run an OAuth flow or enter that service's key. The turn resumes once the connection is made, and the connection is saved under **My connections** in **Settings** → **Integrations**. Services Teable integrates itself and services managed by Composio are both connected from this card, so there is no need to visit the settings page first. **Skip** withholds the connection, and Cuppy continues with the parts that do not depend on it. If connecting fails, the card shows the error: click **Retry** to try again, or **Give up** to end the request.

**Credential request card**: appears when an app or automation you are building needs the credential at run time, naming the service it wants a connection for, or the alias it wants a secret for. You can:

* **Connect my account**: run an OAuth flow; the new connection is granted to the resource automatically.
* **Grant my …**: use a connection or secret you already have.
* **Skip**: withhold the credential. AI continues with the parts that do not depend on it.

Sending a message in the composer while a card waits also closes the card and records it as **Skipped**; your message becomes the next instruction for that turn. If the credential is still needed later, ask Cuppy to request it again.

## Replace, Delete, and Leaving a Space

Before you replace a secret value, delete a secret, or disconnect a connection, Teable lists the apps and automations still using it. Deleting and disconnecting break those resources immediately, so grant them a different credential first if they need to keep running. The old secret value cannot be recovered.

After a new value is saved, an automation picks it up on its next run; an app picks it up when its preview environment restarts, and a published app when you republish it.

When you leave a space where an app or automation still uses your credential, the **Integrations** page flags it with **You left this space**. Click **Remove grant** to stop providing it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.