Skip to main content
Credentials let coding agents use authenticated APIs and hosted MCP servers during a run. A credential belongs to your organization, and you decide which service and coding scenarios may use it. The central promise is:
An authorized agent can use a credential for its intended service without receiving the raw secret value.

​
How Gauge protects credentials

Gauge uses a stored credential only to support the scenarios and integrations your organization configures. The credential remains governed by the permissions and OAuth scopes you chose at the service that issued it.

​
How credentials are used

1

Add a credential

Add an API key or token, or sign in to a hosted MCP service with OAuth. After an API key is saved, Gauge shows only masked identifying information rather than displaying the value again.
2

Approve its destination

Choose the service that may receive the credential. For a custom service, Gauge uses the hostname from the service URL as the boundary.
3

Choose where it is available

Select the credential in a coding scenario when an agent needs to call the API directly. If a hosted MCP server requires the credential, associating it with that server makes it available to scenarios that use the server.
4

Run with limited access

The agent can authenticate to the approved service, but it does not receive the raw secret. Attempts to use the credential with another destination are refused.

​
Domain scoping

Credential access is restricted to an exact host. If you approve api.example.com, the credential can be used at any path on that host, but not at example.com, other.example.com, or an unrelated destination. Domain scoping limits where Gauge will send the credential. It does not reduce what the credential can do after it reaches the approved service. Create vendor credentials with the narrowest permissions or OAuth scopes that the task requires.
A credential is still a capability. An authorized run can perform actions that the credential permits on the approved service, even though the agent cannot view or copy the secret itself.

​
API keys and MCP OAuth

Some OAuth services require you to create an OAuth application first. In that case, Gauge provides the callback URL to register and asks for the client ID and, when required, the client secret.

​
Manage access over time

Manage organization credentials under Settings → Credentials.
  • Rotate a pasted key or token when its value changes. New runs use the replacement without changing the scenario’s credential selection.
  • Reauthorize an OAuth credential when Gauge reports that the authorization needs attention.
  • Delete a credential to remove it from scenarios and revoke its use. Gauge prevents deletion while a live MCP server depends on it so you can remove or update that dependency first.