> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opencompany.sh/llms.txt
> Use this file to discover all available pages before exploring further.
# Credentials
> How OpenCompany stores and connects accounts: API keys, OAuth sign-in, CLI logins, and device pairing
Every external account OpenCompany uses — AI providers, messaging apps, developer tools — connects in one place. Click the **key icon** in the toolbar (tooltip **API Credentials**) to open it.
Connect a service once and every node and agent on the canvas can use it. You never paste a key inside an individual node.
## The Credentials modal
The modal is titled **API Credentials**, with a badge showing how many providers are available. Type in **Search providers...** to filter the list.
The layout has two panels:
* **Left sidebar** — providers grouped into categories: **AI Providers**, **Social Media**, **Productivity**, **Email**, **Android**, **Search**, **Scrapers**, **Services**, **Payments**, **Deployment**, and **Developer Tools**.
* **Right panel** — the selected provider's connection form, status, and actions.
Each provider shows its live state: **Connected** or **Not Connected** for the account, and **Configured** or **Not configured** for saved secrets.
## Four ways services connect
Different services authenticate differently. The modal handles all four styles with the same look and feel.
### API keys
Most providers take a single key. Paste it and click **Validate**. OpenCompany checks the key against the provider, stores it encrypted, and the button flips to **Valid** with a green **Connected** badge.
For AI providers, validation also fetches the live model list, which fills the model dropdowns on your canvas nodes.
| Category | API-key providers |
| ------------ | ------------------------------------------------------------------------------ |
| AI Providers | OpenAI, Anthropic, Gemini, Groq, Cerebras, OpenRouter, DeepSeek, Kimi, Mistral |
| Search | Brave Search, Perplexity |
| Scrapers | Apify, Serper |
| Services | Google Maps |
Google Maps and Apify also use API keys but validate through their own dedicated checks, not the generic model probe. Serper keys save directly without an upstream check.
Local models are free and keyless. For **Ollama** or **LM Studio**, enter the server's **Base URL** and click **Fetch** — the panel shows **Connected** once the model list loads.
Two panels extend the key pattern with extra fields. **Email (IMAP/SMTP)** takes an address, password, and server settings for custom providers — see [Email](/nodes/email). **Telegram Bot** takes a token from @BotFather, then starts the bot connection — see the [Telegram tutorial](/tutorials/telegram-bot).
### OAuth sign-in
OAuth means signing in with your existing account instead of pasting a key. **Google Workspace** and **Twitter/X** use it:
1. Enter the **Client ID** and **Client Secret**, then click **Save Credentials**. Saved secrets display as **Configured** — the value is never shown again.
2. Click **Login with Google Workspace** (or **Login with Twitter/X**). Your browser opens the provider's consent screen.
3. Approve access. The panel flips to **Connected** and shows the signed-in account.
Access tokens refresh automatically in the background, so you sign in once. **Disconnect** revokes the tokens; **Refresh** forces a fresh status check.
Google Workspace requires your own OAuth app in the Google Cloud Console, with the Gmail, Calendar, Drive, Sheets, Tasks, and People APIs enabled. The [Google Workspace guide](/nodes/google-workspace) walks through creating it.
Twitter/X credentials come from the X Developer Portal. Create an app with OAuth 2.0 enabled. The **Client Secret** is optional — the flow uses PKCE.
### CLI logins
Some services authenticate through their own official command-line tool. Click **Login with {name}** and OpenCompany launches that tool's login for you. The CLI holds the credentials in its own storage; OpenCompany records only a connected marker.
* **Stripe** — login opens the Stripe Dashboard. After you authorize, the CLI keeps its credentials in its own config file, and webhook listening starts automatically.
* **GitHub** — the gh CLI (installed automatically) opens `github.com/login/device` in your browser. The one-time code appears in the modal; copy it in, since that page cannot pre-fill it. The token lives in your system credential store, and `gh auth setup-git` runs so git remotes authenticate too.
* **Vercel** — a browser device flow via the auto-installed Vercel CLI. Alternatively, paste an **Access Token (optional)** for headless use; the **Login with Vercel** button works without it.
* **Claude Code CLI** — runs the CLI's browser login in an isolated subprocess. You authorize on claude.ai, and the CLI stores its credentials under OpenCompany's data directory, separate from any personal Claude Code session. The panel flips to **Connected** shortly after the browser step completes.
* **Codex CLI** — follows the same CLI-managed login pattern for OpenAI's Codex tool.
GitHub tokens are never stored by OpenCompany. If you prefer, run `gh auth login` yourself in a terminal on the same machine — the modal picks up the result.
### Device pairing
Two providers pair a physical device by QR code instead of storing a secret:
* **WhatsApp Personal** — click **Start**, then scan the QR code with the WhatsApp mobile app (Linked Devices). **Restart** regenerates the code; **Refresh** re-checks status. The session lives inside the bundled WhatsApp service, not in OpenCompany's credential database.
* **Android Device** — save the relay **API Key** first, then click **Connect** and scan the QR with the Android companion app. The panel tracks two states: the relay link (**Connected**) and the device itself (**Paired**).
Follow the [WhatsApp](/nodes/whatsapp) and [Android](/nodes/android) guides for full pairing walkthroughs.
## Your credentials stay local
Everything you save here lives in a separate encrypted database file, `credentials.db`, on your own machine. Secrets are encrypted with Fernet, an authenticated encryption scheme, and are only decrypted in memory while the server runs. Nothing is ever sent to OpenCompany servers — keys travel only to the provider you are connecting. The encryption key comes from the `API_KEY_ENCRYPTION_KEY` value in your server `.env` file. Keeping credentials in their own file also means workflow exports and database dumps never contain secrets.
If `API_KEY_ENCRYPTION_KEY` changes or goes missing, existing credentials cannot be decrypted. You will need to re-enter them.
## Costs and usage
Provider panels show spend where OpenCompany tracks it. AI provider panels include a collapsible **Usage & Costs** section with token usage and estimated cost per model. **Twitter/X**, **Google Workspace**, and **Google Maps** panels include an **API Usage** section with per-operation request costs. Both sections load their data when you expand them.
## Related pages
Connect one AI provider, or run models locally for free
Create the OAuth app and connect Gmail, Calendar, and Drive
Pair your phone and automate messages