Credentials

Credentials are saved logins to outside services — Google, Stripe, and the like — connected securely so your app can act on someone's behalf. Instead of copying a raw key by hand, you (or your users) connect the service through its official sign-in, and Pikku Studio Cloud remembers the connection. The standout part: your app acts as the right person, using their own login — never one shared master account.

Diagram of the OAuth credential flow: "Your app" then a "Connect" button then an external service login screen then a "Connected" badge back in the Console, label: "Connect outside services securely — no copying keys by hand."

What it's for

Use a credential whenever your app needs to do something as a user in an outside service — read their calendar, charge through their connected account, post on their behalf. You connect the service once through its real login screen, and from then on your app can act with that connection.

"OAuth" is just the standard, secure way services let you connect without sharing your password — it's the same "Continue with Google" flow you've used a hundred times. Developers declare these connections in code with wireCredential(), but in practice they're usually set up for you when you connect an integration in the console, rather than by hand.

How it works

Forwarded per user — no shared master account

This is the part that keeps you safe. When a workflow runs, it runs as the user who triggered it, using that user's own credential. There is no god-mode shared account that can touch everyone's data.

• Permissions cascade from the user's role. Each person can only reach what their own login is allowed to reach — nothing more.
• Audit logs show who did what. Because every action happens as a specific user, you can always trace exactly who triggered what, and when.

So if one user's connection is limited, anything done on their behalf stays within those limits. No single leaked login exposes everyone.

Connecting a service here doesn't put anything live on its own. Like all configuration in Pikku Studio Cloud, your change takes effect on your next deploy.

Which one do I use?

If you're connecting to an outside service's account, it's a credential. The quick rule:

• Are you connecting to a service like Google or Stripe through its login? → Credential — you're in the right place.
• Are you holding a raw API key or token yourself? → Store it as a secret instead.
• Is it a harmless setting like a label or public URL? → Use an environment variable.

Where to go next

• Secrets — for raw API keys and tokens you hold yourself.
• Agents — how automated actions run as the right user, with full audit trails.
• Environment variables — non-sensitive, per-stage settings.