When Perplexity Computer needs to reach a third-party API that does not have a built-in connector, you can securely provide your own API credentials. Your keys are encrypted and stored so they aren’t shared in the agent’s trajectory (the prompts and responses exchanged with third-party models) or with the task sandbox. Providing credentials within a task works on all Perplexity clients; the Credential vault, where you save and manage them, is available on the web.
Overview
Some tools you want Computer to use will not have a built-in connector yet. Custom credentials let you bring your own API credential so Computer can authenticate to that service on your behalf. For example, you can use one to send a transactional email, pull data from an analytics API, or look up sports scores from a data provider. Computer supports the authentication methods these APIs use: tokens, custom headers, query parameters, and usernames and passwords. If you provide a username and password, Computer saves them as a Basic auth credential so it can authenticate to the API securely.
When a task needs credentials, Computer prompts you with a secure form. Your credential is encrypted and injected into outgoing API requests through a secure proxy, so the raw value isn’t shared with the agent or the task sandbox. You choose how long a credential lasts: just this task, saved to your personal vault for reuse, or shared with a project so your teammates can use it too. A credential you add in a task stays available for the duration of the Computer session, and you can revoke it at any time. If you save it to your personal vault, Computer uses it automatically when a task needs it, because new credentials are set to Always allow. You can switch a credential to Ask for approval in your Credential vault.
Why use custom credentials?
Connect services without a built-in connector. Bring your own API key for a third-party tool so Computer can work with it right away.
Keep secrets out of the agent’s view. Credentials are encrypted and injected through a secure proxy, so the raw value isn’t shared with the agent or the sandbox.
Reuse keys across your tasks. Save a credential to your personal vault once and let Computer reuse it in future tasks.
Share access with a project. Add a credential to a project so everyone on the team can use it, without sharing the raw key.
Stay in control. For each saved credential, you can choose whether to let Computer use it without your approval, or to have Computer ask for your approval before using it in a task.
Before you add a custom credential, check whether the service already has a built-in connector. Connectors are the preferred way to link a third-party service, and Computer will use one when it is available. Use custom credentials for services that do not have a connector yet.
If the service has a built-in connector, that connector can also appear inside a plugin. Connecting it anywhere connects it for your account everywhere, and your connection and your organization’s connector settings apply inside every plugin. See What are plugins?
The three credential scopes
Credentials come in three scopes, based on how long they last and who can use them:
Session (single task): Used only within the current task, and not saved for reuse.
Personal (Credential vault): Saved to your personal Credential vault and reusable across your own tasks.
Project (shared): Saved to a project so everyone on the team can use it.
The sections below explain how each one works.
Session credentials (single task)
Session credentials are the simplest option: you provide a key for one task, and it is not saved.
You are prompted in the task. When a task needs a credential, Computer surfaces a secure form for you to enter it. It pre-fills details like the host, name, and credential type where it can.
It is encrypted and proxied. Your credential is encrypted and injected into outgoing API requests through a secure proxy, so the raw value isn’t shared with the agent or the sandbox.
It lasts for the whole task. Once added, the credential is available for the rest of that task, including follow-up requests.
It is not saved. Session credentials are not stored for reuse — start a new task and you will be prompted again. You will have the option to save the credential to your vault if you want to reuse it in the future.
Figure 1 — The secure form Computer shows in a task when it needs a credential.
Personal credentials (Credential vault)
Save a credential to your personal vault to reuse it across your own tasks without re-entering it each time.
Save from the task form. When Computer prompts you for a credential, choose the option to save it to your Credential vault to reuse it across Computer tasks.
Or add it directly. Go to Settings > Credential vault to add and manage credentials outside of a task.
Choose when Computer asks. New credentials are set to Always allow, so Computer recognizes your saved credential and uses it when a task needs it. To approve each use instead, switch the credential to Ask for approval in your Credential vault.
It stays private to you. Personal credentials belong to your account and are not shared with anyone else.
Figure 2 — Saved credentials in the Credential vault, each with its approval setting.
Project credentials (shared with a team)
Add a credential to a project so everyone working in that project can use it — useful for a shared key your team relies on.
Add it in the project. In the project’s sidebar, find the Credential vault section and select Manage to add a project credential.
Everyone in the project can use it. All members of the project can use the credential in their tasks, without seeing the raw value.
Writers manage it. You must be at least a writer on the project to add or revoke a project credential, following the same access rules as project connectors.
Choose when Computer asks. New project credentials are set to Always allow, so Computer can use them in a task without asking. Switch a credential to Ask for approval if you want Computer to ask before each use.
Figure 3 — Project credentials in the project’s sidebar.
Managing your credentials
Find your vault in Settings > Credential vault. Your personal Credential vault lives in your account settings. If you see Plugins in the sidebar, you may also be able to open it from there: select Add custom, then Connect your own API. That option appears only when your plan and your organization’s settings allow custom connectors.
Add, review, or remove keys. Open the Credential vault to add a new credential, review the ones you have saved, or remove one you no longer need.
Manage project credentials in the project. Add or revoke a project’s credentials from the Credential vault section in the project’s sidebar. You must be at least a writer on the project.
Limits and privacy
Your raw key stays hidden. Credentials are encrypted and injected through a secure proxy, so the raw value isn’t shared with the agent or the task sandbox.
API requests only. Custom credentials are supported for API requests that Computer can route through the secure proxy. Other secret types, such as SSH keys, are not supported today.
Saved credentials are set to Always allow by default. Computer uses a saved personal or project credential in a task without asking, unless you switch that credential to Ask for approval. Credentials saved before this default keep the setting they already had.
Session credentials are not stored. A session credential is used only within that Computer session, can be revoked at any time, and is not saved for reuse in later sessions, unless you explicitly choose to save the credential to your Credential vault.
Frequently asked questions
What is the difference between a session, personal, and project credential?
A session credential is used only in the current task and is not saved. A personal credential is saved to your Credential vault and reusable across your own tasks. A project credential is saved to a project so everyone on that team can use it. Saved credentials are set to Always allow by default, and you can switch any of them to Ask for approval.
Should I use a connector or a custom credential?
If the service has a built-in connector, use the connector — it is the preferred way to connect a third-party service. Use a custom credential when there is no connector available for the tool you need.
Can Computer see my API key?
No. Your credential is encrypted and injected into outgoing requests through a secure proxy, so the raw value isn’t shared with the agent or the task sandbox. If an API includes your credential in its response, for example by echoing request headers back, Computer can see that response.
Why is Computer asking me to approve a credential?
Computer asks for approval only when a saved personal or project credential is set to Ask for approval. New credentials are set to Always allow, but credentials saved before this default keep the setting they already had. To stop the prompts for a credential, select Always allow within that credential’s settings in your Credential vault.
How do I reuse a credential in a future task?
Save it to your Credential vault when Computer prompts you, or add it directly from the vault. In later tasks, Computer recognizes it and uses it, or asks you first if the credential is set to Ask for approval.
Where do I find my Credential vault?
Go to Settings > Credential vault. If you see Plugins in the sidebar, you may also be able to open it from there: select Add custom, then Connect your own API. That option appears only when your plan and your organization’s settings allow custom connectors.
Can my teammates use my keys?
Yes, if you add them as project credentials. Personal credentials are private to your account. Project credentials can be used by everyone in the project, and you must be at least a writer on the project to add or revoke them.
Can I store other secrets, like an SSH key?
No. Custom credentials support API requests that route through the secure proxy. Other secret formats, such as SSH keys, are not supported today.
Is the username and password the same as my login to that service’s website?
No. When you provide a username and password, Computer saves them as a Basic auth credential for authenticating to the service’s API. It is not a general-purpose login for signing in to that service’s website. Custom credentials are only used to authenticate API requests, using tokens, custom headers, query parameters, or Basic auth. If you are unsure which value to enter, check the API’s documentation for how it expects requests to be authenticated.
Related articles
Need more help?
Contact us via Help > Contact Support. Include the task link if your question is about a specific Computer task.