Credentials

Every external account OpenCompany uses — AI providers, messaging apps, developer tools — connects in one place. Click the key icon in the toolbar (tooltip API Credentials) to open it. Connect a service once and every node and agent on the canvas can use it. You never paste a key inside an individual node.

​

The Credentials modal

The modal is titled API Credentials, with a badge showing how many providers are available. Type in Search providers… to filter the list. The layout has two panels:

• Left sidebar — providers grouped into categories: AI Providers, Social Media, Productivity, Email, Android, Search, Scrapers, Services, Payments, Deployment, and Developer Tools.
• Right panel — the selected provider’s connection form, status, and actions.

Each provider shows its live state: Connected or Not Connected for the account, and Configured or Not configured for saved secrets.

​

Four ways services connect

Different services authenticate differently. The modal handles all four styles with the same look and feel.

​

API keys

Most providers take a single key. Paste it and click Validate. OpenCompany checks the key against the provider, stores it encrypted, and the button flips to Valid with a green Connected badge. For AI providers, validation also fetches the live model list, which fills the model dropdowns on your canvas nodes.

​

OAuth sign-in

OAuth means signing in with your existing account instead of pasting a key. Google Workspace and Twitter/X use it:

1. Enter the Client ID and Client Secret, then click Save Credentials. Saved secrets display as Configured — the value is never shown again.
2. Click Login with Google Workspace (or Login with Twitter/X). Your browser opens the provider’s consent screen.
3. Approve access. The panel flips to Connected and shows the signed-in account.

Access tokens refresh automatically in the background, so you sign in once. Disconnect revokes the tokens; Refresh forces a fresh status check.

​

CLI logins

Some services authenticate through their own official command-line tool. Click Login with and OpenCompany launches that tool’s login for you. The CLI holds the credentials in its own storage; OpenCompany records only a connected marker.

• Stripe — login opens the Stripe Dashboard. After you authorize, the CLI keeps its credentials in its own config file, and webhook listening starts automatically.
• GitHub — the gh CLI (installed automatically) opens github.com/login/device in your browser. The one-time code appears in the modal; copy it in, since that page cannot pre-fill it. The token lives in your system credential store, and gh auth setup-git runs so git remotes authenticate too.
• Vercel — a browser device flow via the auto-installed Vercel CLI. Alternatively, paste an Access Token (optional) for headless use; the Login with Vercel button works without it.
• Claude Code CLI — runs the CLI’s browser login in an isolated subprocess. You authorize on claude.ai, and the CLI stores its credentials under OpenCompany’s data directory, separate from any personal Claude Code session. The panel flips to Connected shortly after the browser step completes.
• Codex CLI — follows the same CLI-managed login pattern for OpenAI’s Codex tool.

​

Device pairing

Two providers pair a physical device by QR code instead of storing a secret:

• WhatsApp Personal — click Start, then scan the QR code with the WhatsApp mobile app (Linked Devices). Restart regenerates the code; Refresh re-checks status. The session lives inside the bundled WhatsApp service, not in OpenCompany’s credential database.
• Android Device — save the relay API Key first, then click Connect and scan the QR with the Android companion app. The panel tracks two states: the relay link (Connected) and the device itself (Paired).

Follow the WhatsApp and Android guides for full pairing walkthroughs.

​

Your credentials stay local

Everything you save here lives in a separate encrypted database file, credentials.db, on your own machine. Secrets are encrypted with Fernet, an authenticated encryption scheme, and are only decrypted in memory while the server runs. Nothing is ever sent to OpenCompany servers — keys travel only to the provider you are connecting. The encryption key comes from the API_KEY_ENCRYPTION_KEY value in your server .env file. Keeping credentials in their own file also means workflow exports and database dumps never contain secrets.

​

Costs and usage

Provider panels show spend where OpenCompany tracks it. AI provider panels include a collapsible Usage & Costs section with token usage and estimated cost per model. Twitter/X, Google Workspace, and Google Maps panels include an API Usage section with per-operation request costs. Both sections load their data when you expand them.

​

Related pages