Credentials

The @culvii/kit SDK has no auth API and never carries a credential itself. Connect a provider once in the Console, under Integrations, and Console gives that connection an ID. Reference that ID (a step's credentials.id, an agent's model.credentialId) and the platform resolves the actual secret at call time. Integrations are scoped like most things in Culvii, tenant-wide, environment-wide, or to a single workspace, and a connection made at a broader scope is available to anything narrower.

Every provider is either token (paste a secret directly, like the model providers) or oauth (a consent-flow redirect, like Gmail or Slack). Either way, using the connection from a definition looks identical: a credentialId or credentials.id referencing that connection's ID.

Using credentials with Culvii

A step from a credentialed connector references its credential by ID:

import { Step } from '@culvii/kit';

const sendEmail = new Step({
  name: 'Send Email',
  type: 'gmail',
  credentials: { name: 'My Gmail Account', id: 'credential-id-here' },
  params: {
    resource: 'message',
    operation: 'send',
    toRecipients: 'customer@example.com',
    subject: 'Your request has been received',
    bodyContent: 'We\'ll follow up shortly.',
  },
});

An agent's model.credentialId (see MultiAgentEngine) works the same way, a reference, never a raw key:

import { MultiAgentEngine } from '@culvii/kit';

const supportAgent = new MultiAgentEngine({
  id: 'support-agent',
  name: 'Support Agent',
  role: 'primary',
  systemPrompt: 'Answer customer questions.',
  model: { provider: 'anthropic', modelId: 'claude-sonnet-4-5', credentialId: 'my-anthropic-credential' },
  secondaryAgents: [],
});

Neither definition ever carries the actual secret. The platform resolves credentials.id and model.credentialId against the connection stored in Integrations at call time, and that connection is encrypted at restCulvii cannot see your secrets. They're encrypted before they're ever stored, and only decrypted in memory, for the duration of the call that needs them., never held anywhere in plaintext.