Credentials

Credentials are encrypted API keys, auth tokens, and login secrets that Hubi's browser agent uses to access sites and services on your behalf. Save them once, and Hubi can log in, fill forms, and pull data the next time you ask it to.

How Credentials Differ from Integrations

• Integrations are pre-built connections to specific apps (Slack, Google, HubSpot, Shopify, and 1,000+ more). They use OAuth and Hubi knows exactly how to talk to each app.
• Credentials are for everything else - any site or API that doesn't have a dedicated integration. You provide the URL, headers, and any keys, and Hubi's browser agent figures out the rest.

Use credentials when there's no integration available for a site you want Hubi to use, or when you want Hubi to log in to a private dashboard, paywall, or internal tool.

Per-User, Not Workspace-Wide

Each credential belongs to you, not the workspace. Other workspace members can't see your credentials, and Hubi only uses them when you're the one driving the task. This keeps your personal logins private even in shared workspaces.

Adding a Credential

Drawer > Capabilities > Credentials > Add Credential.

Provide:

• Name - Anything you'll recognize later ("Internal Analytics Dashboard," "Stripe API key," etc.).
• URL - The endpoint or site Hubi should use the credential on.
• Headers / API key - Whatever the service requires (Bearer token, X-API-Key, basic auth, etc.).

Save, and the credential is immediately available the next time you ask Hubi to interact with that URL.

Editing and Removing

• Edit - Tap a credential > update fields > Save.
• Delete - Tap a credential > Delete > confirm. Hubi loses access immediately; if you re-add the credential later it's a fresh entry.

Security

All credentials are encrypted at rest. They are never displayed in plain text after entry - only the name, URL, and a masked indicator that a value exists. If you forget a key, delete the credential and add it again with the fresh value.

Browser Agent

When you give Hubi a task that requires logging into a site, the browser agent looks for a matching credential first. If one exists, it uses it; if not, it tells you what's missing. The browser agent runs in a persistent sandbox per workspace, so Hubi keeps cookies and form state between turns and doesn't have to re-authenticate at every step of a multi-step task.