> ## Documentation Index
> Fetch the complete documentation index at: https://failfast.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Store the authentication a workflow node needs to call a service, once, and reuse it everywhere.

Some workflow nodes call protected services — external APIs, tracking platforms, or Fail Fast itself. A credential stores the authentication those calls need. You create a credential once, and every workflow in your workspace can reuse it: update it in one place and all the nodes that use it pick up the change.

<Note>
  Credentials are managed from within workflow nodes. When you configure a node that needs authentication, you choose an existing credential or create a new one right there — there is no separate credentials screen to visit first.
</Note>

## Generic credential types

For nodes that call arbitrary services — most commonly the **HTTP Request** node — you pick the authentication method the target service expects:

| Type        | What it covers                                           |
| ----------- | -------------------------------------------------------- |
| Basic Auth  | Username and password sent with each request.            |
| Bearer Auth | A bearer token sent with each request.                   |
| Custom Auth | A custom authentication scheme defined by you.           |
| Digest Auth | Digest-based challenge authentication.                   |
| Header Auth | An authentication value sent in a request header.        |
| OAuth2 API  | Connects through an authorization flow with the service. |
| Query Auth  | An authentication value sent as a query parameter.       |
| JWT Auth    | Authentication with a JSON Web Token.                    |
| None        | No authentication — for open services.                   |

## Predefined service credentials

Nodes for specific services come with their own credential type, shaped to what that service requires. Predefined credentials exist for the **Fail Fast**, **Truora**, **Monitor**, **RNDC**, and **Satrack** nodes. When you configure one of these nodes, it asks for its matching credential — see the [Node reference](/docs/automation/nodes) for what each node does.

## Create a credential from a node

<Steps>
  <Step title="Open the node's configuration">
    On the workflow canvas, open the node that needs authentication.
  </Step>

  <Step title="Choose or create a credential">
    In the credential selector, pick an existing credential — or create a new one if none fits.
  </Step>

  <Step title="Fill in the authentication details">
    Enter what the credential type asks for, such as a token, a username and password, or a header value.
  </Step>

  <Step title="Save and continue">
    Save the credential. The node now uses it, and it becomes available to reuse in other workflows.
  </Step>
</Steps>

## Connect an OAuth2 credential

OAuth2 credentials don't take a fixed secret — they connect through an authorization flow with the service itself.

<Steps>
  <Step title="Create an OAuth2 API credential">
    From the node's credential selector, create a new credential and choose the OAuth2 API type.
  </Step>

  <Step title="Complete the authorization flow">
    Follow the connection flow to authorize Fail Fast with the external service, signing in and granting access on the service's side.
  </Step>

  <Step title="Use it in your nodes">
    Once connected, select the credential in any node that calls that service.
  </Step>
</Steps>

<Tip>
  Reuse one credential per service across all your workflows rather than creating duplicates. When the service's token or password changes, you update a single credential and every workflow keeps working.
</Tip>

## Credentials vs API keys

Credentials authenticate your workflows to outside services. If instead an outside system needs to authenticate to Fail Fast, that's handled with [API keys](/docs/admin/api-keys).