Credentials

Agents receive access, never the secret. Every credential — OAuth grants, custom headers, cloud role sessions — lives in a per-organization vault, write-only from the moment it’s stored, and is resolved fresh for each tool call at the scope the server defines.

Two scopes

Personal credentials are yours: created when you click Connect in Connected Services, used whenever an agent acts for you, and removed the moment you Disconnect. Tools running on a personal credential authenticate as you and see what you can see.

Organization credentials are shared: an admin-registered header set, a GitHub App installation, or a service that authenticates the workspace as a whole. Which scopes a server supports is fixed by its catalog entry; both can exist side by side, and Data scoping covers choosing between them.

What connecting actually does

Connect runs a standard OAuth authorization against the service itself — you sign in and consent on their domain, and Lunen receives only the resulting tokens. Under the hood the flow is hardened by default: PKCE on every authorization, the callback pinned to Lunen’s own configured address, and — where servers support it — automatic client registration, so most catalog servers need no OAuth app configured by anyone.

Tokens refresh automatically ahead of expiry. When a refresh can’t save a credential — the grant was revoked upstream, or the session truly expired — the affected run pauses with a Reconnect … to continue prompt rather than failing: reconnect, and the run resumes where it stopped.

What’s never available

Credential values cannot be read back — not by members, not by administrators, not by agents. The dashboard shows that a connection exists and when it changed, never its contents; sensitive header values are write-only from the moment they’re saved; and audit events record every credential write with the value redacted. An agent’s transcript can contain what a tool returned, but never the credential the call ran on.