Protect credentials and secret headers

Use secret headers

Enter API credentials under Secret headers, never in public headers, parameters, request bodies, or descriptions.

{"Authorization":"Bearer YOUR_TOKEN"}

Secrets are encrypted and not shown again. When editing, leave the field empty to keep existing secrets; enter a value only to replace them.

Apply least privilege

• Create a credential specifically for Inceptiva.
• Limit it to required endpoints and operations.
• Separate test and production credentials.
• Define expiration and rotation procedures.
• Revoke any secret that may have been exposed.

Avoid sensitive response data

Execution history shows request, result, and error summaries. Configure the external API not to return passwords, tokens, or unnecessary personal data.

Do not place secrets in agent instructions, knowledge documents, screenshots, or test conversations.