> For the complete documentation index, see [llms.txt](https://docs.brigge.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.brigge.ai/documentation/brigge-for-engineers/credentials.md).
# Credentials
## Overview
*Credentials* are the saved login details a system uses to authenticate when a pipeline runs. To use a *System* in a pipeline, you select a set of *Credentials* and an *Endpoint*. For example:
## How credentials relate to systems
Credentials are directly associated with an [Authentication flow](/documentation/brigge-for-engineers/systems.md#authentication-flows), which is configured in the underlying *System* setup. So, when *Credentials* are added and subsequently applied in pipelines, they inherit settings for the given *Authentication flow.*
It's useful to understand these relationships, especially if you're [building custom systems](/documentation/brigge-for-engineers/systems.md#building-custom-systems). The illustration below shows the key relationships:
Here, we can see:
{% stepper %}
{% step %}
**The linked system**
At the top level, a [*System*](/documentation/brigge-for-engineers/systems.md) (e.g. Workday) is configured with [*General Settings*](/documentation/brigge-for-engineers/systems.md#general-details) (e.g. `rate limit`, `date format`, and `timezone`), [*Authentication flows*](/documentation/brigge-for-engineers/systems.md#authentication-flows), and [*Endpoints*](/documentation/brigge-for-engineers/systems.md#endpoints).
{% endstep %}
{% step %}
**Adding credentials**
You add *Credentials* for a *System*, first selecting an *Authentication flow*. All *Authentication flows* configured for the *System* are available for selection. You are then prompted to provide authentication details for whichever flow you selected.
{% endstep %}
{% step %}
**Inherit or override authentication flow settings**
When [adding credentials](#adding-credentials), general *System* settings (`rate limit`, `date format`, and `timezone`) are inherited by default - you can override them if needed.
{% hint style="info" %}
**Why is this useful?**
A *System* might have multiple sets of credentials - for example, one set to access *Production* data, and another set for *Sandbox* data. You may want to (for example) apply a different rate limit for each environment.
{% endhint %}
{% endstep %}
{% step %}
**Inherit authentication variables**
An *Authentication flow* may be configured with [authentication variables](/documentation/brigge-for-engineers/systems.md#working-with-authentication-flow-variables) that are injected into [*Endpoints*](/documentation/brigge-for-engineers/systems.md#endpoints) at runtime.
So, when a pipeline [*Connector* node](/documentation/brigge-for-transformers/pipelines/pipeline-nodes/connector-node.md) is configured to use a given set of *Credentials* and an *Endpoint* - and that endpoint references an authentication variable - that variable is resolved from the underlying *Authentication flow* setup.
{% hint style="info" %}
**Why is this useful?**
Suppose your *System* is configured with endpoints where the base URL is different for *Sandbox* and *Production* data. For example:
* `GET` `https://example.com/sandbox/api/1.0/contacts`
* `GET` `https://example.com/production/api/1.0/contacts`
To simplify this, the *System* might be configured with two 'flavours' of the same *Authentication flow*
* *API Key Sandbox* (includes a `base_url` variable with a value set to `https://example.com/sandbox/api/1.0`).
* *API Key Production* (includes a `base_url` variable with a value set to `https://example.com/production/api/1.0`).
Endpoints for this *System* would reference the `base_url` variable, for example:
`GET` `{{base_url}}/contacts`
Then:
* When the *API Key Sandbox* credentials are used in a pipeline, the variable resolves to `https://example.com/sandbox/api/1.0/contacts`.
* When the *API Key Production* credentials are used in a pipeline, the variable resolves to `https://example.com/production/api/1.0/contacts`.
{% endhint %}
{% endstep %}
{% step %}
**Easy auth rotation**
If authentication credentials change - for example, if an API key or token expires - all you need to do is update the relevant set of *Credentials*. The new details are applied throughout pipelines, wherever these credentials are used.
{% endstep %}
{% endstepper %}
## Working with credentials
Adding credentials
To add new credentials for a system, follow the steps below.
{% stepper %}
{% step %}
**Find the required system**
Select *Systems* from the navigation menu, then find the system you want to update.
{% endstep %}
{% step %}
**Add credentials**
Click the `add credentials` (plus symbol) option. For example:
{% endstep %}
{% step %}
**Provide a name for this credential set**
Enter a name to identify this set of credentials throughout Brigge:
{% hint style="info" %}
This is the name that pipeline users will see when configuring connector nodes.
{% endhint %}
{% endstep %}
{% step %}
**Review /** **override advanced settings (optional)**
If you want to review/override [general settings inherited from the system](/documentation/brigge-for-engineers/systems.md#general-details), click the `advanced fields` 'expand' option. For example:
Any changes made here are only applied to pipeline runs where this set of credentials is used:
{% endstep %}
{% step %}
**Choose an authentication method**
When prompted, select an *Authentication method*. For example:
One or more authentication methods will be shown - choose whichever one you have credentials for, then click `next`.
{% endstep %}
{% step %}
**Follow the authentication flow**
Subsequent screens and options will vary, depending on the selected authentication method - but generally you will step through at least one page to enter authentication details. For example:
{% endstep %}
{% endstepper %}
Updating credentials
If you need to update existing credentials for a system (for example, to change an expired API key), follow the steps below.
{% stepper %}
{% step %}
**Access options for the credential set**
Click the three-dot menu for the required credential set. For example:
{% endstep %}
{% step %}
**Edit existing credentials**
Select the `edit credentials` option. For example:
{% endstep %}
{% step %}
**Make required changes**
Update existing credentials as needed and save changes. For example:
{% hint style="info" %}
Having saved credentials, changes take effect immediately - next time a pipeline runs using this set of credentials, the latest details are used.
{% endhint %}
{% endstep %}
{% endstepper %}
Deleting credentials
If credentials are no longer used, you can delete them. To do this, follow the steps below.
{% stepper %}
{% step %}
**Access options for the credential set**
Click the three-dot menu for the required credential set. For example:
{% endstep %}
{% step %}
**Delete credentials**
Select the `delete credentials` option. For example:
