Skip to main content
The Credentials system stores sensitive values (passwords, payment cards, and secrets) so your workflows can use them without embedding secrets in prompts or parameters. Skyvern stores credentials by default with no external service required.

​
How Skyvern keeps credentials secure

Sensitive credential data never reaches the LLM, logs, or API responses.
1

Encrypted at rest

When you save a credential, the sensitive data (passwords, card numbers, CVVs, and TOTP secrets) is sent to a secure vault that provides encryption at rest. Skyvern supports multiple vault backends: Bitwarden, 1Password, Azure Key Vault, and custom webhook providers. Skyvern’s own database stores only non-sensitive metadata: credential name, username, card last four digits, card brand, TOTP method, and similar identifiers. Passwords, full card numbers, CVVs, and TOTP secrets are stored exclusively in the vault.
2

Placeholders during execution

When a workflow runs, the LLM receives only placeholder IDs like placeholder_Xk9m_password. The AI decides where to type on the page, but never sees the real values. No third party, including the LLM provider, ever accesses your actual credentials.
3

Just-in-time injection

At the browser level, the automation layer resolves placeholders to real values and types them directly into the page. After execution, credential values that appear in HTTP Request block responses, block context snapshots, and conditional evaluation outputs are automatically masked before storage.

​
Quick start

1

Create a credential

Use the API to create a password, credit card, or secret credential. See the Password Credentials or Credit Cards pages for examples.
2

Reference in workflows

Pass the credential_id to a Login block or Browser Action block. Skyvern fills in the username, password, and 2FA code (if configured) automatically.
3

Run your workflow

The automation layer resolves credential placeholders at runtime and types them directly into the page.

​
What you can store

Password Credentials

Username, password, and optional 2FA configuration for automated logins

Credit Card Credentials

Payment card details for purchase and checkout workflows

Secret Credentials

A single sensitive string such as an API key, bearer token, or any value you don’t want hardcoded

​
Secret credentials

Secrets store a single sensitive value (an API key, bearer token, or similar). Create one via the API:
Python
from skyvern import Skyvern

skyvern = Skyvern(api_key="YOUR_API_KEY")

credential = await skyvern.create_credential(
    name="Stripe API Key",
    credential_type="secret",
    credential={
        "secret_value": "sk_live_abc123",
        "secret_label": "api-key"
    }
)
Reference it in HTTP Request, Code, or Workflow Trigger blocks using the credential parameter’s key: 
{{ parameter_key.secret_value }}
Replace parameter_key with the key assigned to the credential parameter in the workflow editor (e.g., credentials, credentials_1).

​
API endpoints

Skyvern provides a comprehensive REST API for credential management:
MethodEndpointDescription
POST/v1/credentialsCreate a new credential
GET/v1/credentialsList all credentials for the organization
GET/v1/credentials/{credential_id}Get a specific credential
POST/v1/credentials/{credential_id}/updateUpdate credential data
PATCH/v1/credentials/{credential_id}Rename credential
POST/v1/credentials/{credential_id}/deleteDelete a credential
POST/v1/credentials/{credential_id}/testTest a credential with a login
GET/v1/credentials/{credential_id}/test/{workflow_run_id}Get test status
POST/v1/credentials/{credential_id}/test/{workflow_run_id}/cancelCancel a credential test
POST/v1/credentials/test-loginTest login with inline credentials
POST/v1/credentials/totpSend TOTP/2FA code
GET/v1/credentials/totpList TOTP codes
See the individual credential type pages for detailed API examples.

​
Deleting credentials

Deletion is permanent and cannot be undone. If a workflow references a deleted credential, the run will fail during initialization until you assign a replacement.
Python
await skyvern.delete_credential(credential_id="cred_1234567890")

Password Credentials

Store logins with optional 2FA

Credit Card Credentials

Store payment details for checkout workflows

TOTP / 2FA Setup

Configure and manage two-factor authentication

Bitwarden Integration

Connect Bitwarden for enterprise credential management

Build docs developers (and LLMs) love

Get started for freeTalk to us