Skip to content
Dash
Get started for free Get started for free

Store credentials

Some tasks require credentials that Dash doesn’t get through OAuth, like an API key for a private service, a database connection string, or an environment variable a code task needs. The credential vault stores these securely so Dash can use them during code execution without you pasting them into a message.

How the vault works

Section titled “How the vault works”

Each workspace has a default credential vault. Secrets stored in the vault are:

  • Encrypted at rest — stored server-side, never in plain text.
  • Never shown after creation — once you save a credential, Dash never displays the value again. You can delete and recreate, but not view.
  • Available to code execution — when Dash runs code in its sandbox, vault credentials are injected as environment variables.
  • Workspace-scoped — the vault belongs to the workspace, not a single person. Any Dash conversation in the workspace can use the credentials.

Add a credential

Section titled “Add a credential”
  1. Go to app.dashpup.ai and open the Credentials page (under workspace settings).
  2. Click Add credential.
  3. Enter a name (this becomes the environment variable name, e.g. INTERNAL_API_KEY).
  4. Enter the value (the secret itself).
  5. Save.

The credential is immediately available to Dash’s code execution environment.

Use a credential in a task

Section titled “Use a credential in a task”

When Dash runs code, vault credentials are available as environment variables. For example, if you stored a credential named INTERNAL_API_KEY, Dash can access it as process.env.INTERNAL_API_KEY in a code task.

You don’t need to tell Dash the value. Just tell Dash which credential to use:

@Dash call the internal reporting API using the INTERNAL_API_KEY credential and pull this month’s numbers.

Delete a credential

Section titled “Delete a credential”

On the Credentials page, click the menu next to a credential and select Delete. The credential is removed immediately and any task that depends on it will fail until a replacement is added.

What not to store here

Section titled “What not to store here”
  • OAuth tokens — these are managed automatically through tool connections. Don’t paste them into the vault.
  • Passwords for tools Dash already connects to — use the OAuth connection flow instead.

The vault is for credentials that have no other path into Dash: private API keys, internal service tokens, third-party keys for tools without OAuth support.

What’s next

Section titled “What’s next”