Credentials overview

Team credentials

Team credentials define a shared identity that all users of an agent use. Team credentials come from a shared service account that is managed by builders or administrators and represent a single identity for accessing the external application. Users are never prompted for team credentials.

Team credentials are suited for scenarios that require shared permissions, user‑independent requests, or service‑level access.

Member credentials

Member credentials represent the individual identity of each user in the external application. These credentials allow actions to run on behalf of the user, enabling external systems to apply user-specific permissions, roles, and access policies. Member credentials originate directly from the user’s own application identity and ensure that the external system applies the correct authorization for that specific user.

• Member credentials (Draft): Member credentials are used only during testing. Each user provides personal credentials when the tool runs in preview chat.

• Member credentials (Live): The user enters personal credentials when the tool needs access to the external system in the live environment. These credentials are stored securely for future requests.

• Member credentials (SSO): SSO replaces manual credential entry. The authenticated identity is passed automatically when the channel supports delegated access.

The following table summarizes where team and member credentials originate and how they are collected across Draft and Live interactions.

Credential management in watsonx Orchestrate ensures that each integration uses the appropriate identity, whether shared or individual, and supports consistent authentication behavior across draft and live environments. By understanding how team and member credentials originate and how they are used at run time, you can design integrations that meet security requirements and each application’s authorization model.

Credential parameters by authentication type

The credential parameters vary depending on the authentication type used.

Managing OAuth2 Authentication during connection setup

When you configure team and member credentials for OAuth2 Authorization Code or OAuth2 Client Credentials, the system includes an additional confirmation step during configuration for both the draft and live environments. You can complete authentication immediately by clicking Continue, or skip authentication and finish later by clicking Skip for now.

If authentication is completed, the system establishes the connection as part of the setup and makes it available for use. If authentication is skipped, the configuration is saved without establishing the connection, and you must complete authentication later before you can use the connection. The location for completing authentication depends on whether the connection uses team credentials or member credentials.

• Complete authentication during configuration

  Complete authentication during configuration to make the connection available immediately.

  • Click Continue.
  • The system redirects you to the target application.
  • Authorize the integration.
  • The system establishes the connection and makes it available for use in the selected environment (draft or live).

• Skip authentication during configuration

  Skip authentication if you want to complete it later.

  To skip authentication during configuration:

  • Click Skip for now.
  • The system saves the configuration in the selected environment (draft or live), but does not activate the connection.

  The connection remains unavailable in that environment until you complete authentication.

Credential support by deployment type

Credential behavior varies depending on where the workflow runs. The following table summarizes the credential support for each deployment type to help you determine which configuration is appropriate for your use case.