ctx.credentials

Agents read credentials the delegator already stored. Access is scoped to the delegation, every read is audited, and the agent cannot write secret values.

Read a credential

get returns one value. mget returns several.list returns names only. Do not log the values.

const apiKey = await ctx.credentials.get('stripe_api_key');

const { api_key, api_secret } = await ctx.credentials.mget([
  'api_key',
  'api_secret',
]);

if (await ctx.credentials.has('optional_api_key')) {
  const names = await ctx.credentials.list();
  ctx.log.info('credential names available', { count: names.length });
}

A missing grant throws AccessDeniedError. Request a broader delegation through ctx.credentials.request when the workflow needs a credential the current grant does not include.