> For the complete documentation index, see [llms.txt](https://docs.autommate.com/userguide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autommate.com/userguide/integrations-and-api/apps-connections-and-authentication.md). # Apps, connections, and authentication An app supplies actions for a connected system. A credential supplies the authorization needed to call that system. Installing or selecting an app does not, by itself, authorize access to customer data. Open Build → Apps for applications and Catalog → App Store for the store. Legacy documentation uses Libraries and Library Store for related capabilities. ### Prepare the connection Before configuring credentials, record the target application's environment and URL, the required operations, the credential owner, and the permissions needed by those operations. Use a test account or test environment where available. The Vault separates **App Credentials** from **Custom Credentials**. App Credentials are associated with an application; Custom Credentials hold named values used by a particular integration or process. ### App Credentials Fields include **Credential Name**, **Application**, **Owner**, and **Authentication Type (Auth Type)**. Connection setup also includes **Connector Name** and, where applicable, **URL**. Select the authentication method supported by the application, such as OAuth, OAuth 2.0, Basic Authentication, API Key or Access Token. The available choices depend on that connector. For OAuth, follow the connector and provider requirements for permissions, consent, redirects, token lifetime, and refresh. Do not add broad scopes simply because another integration used them. When a connection expires, diagnose the provider's actual response before replacing credentials. ### Custom Credentials Custom-credential fields include **Credential Name**, **Credential Description**, **Variable Name**, **Variable Description**, **Variable Value**, and **Is Masked?**. Use descriptive names that identify purpose and environment without including the secret value. Mask sensitive values where supported, and check diagnostic output before sharing a test result. A masked input does not establish that every downstream response or script log is also masked. ### Verify the connection 1. Select the intended credential in a read-only action. 2. Query a known test record. 3. Confirm that the returned record belongs to the expected environment and account. 4. Test only the additional operations the workflow actually needs. If authentication succeeds but an operation is rejected, inspect the target application's permissions and object access. Do not solve a missing permission by granting an unrestricted administrator role without understanding the requirement. ### Maintain it Record the app version and the flows that depend on the connection. Before editing, disconnecting, or deleting a credential, identify its consumers. After rotating it, repeat a controlled connection test and verify an intended consumer. Keep connection ownership and recovery contacts current so that a departed employee or expired token does not leave an automation without support. ### Separate the connection from the action test
Example: Application Credentials shows provider-specific WhatsApp fields after selecting the app and authentication type. Other app credentials use their own authentication requirements.

Example: Application Credentials shows provider-specific WhatsApp fields after selecting the app and authentication type. Other app credentials use their own authentication requirements.

Start with one app credential and one read operation against a known test record. This lets you tell an authentication problem from an action-input problem. 1\. Open the app credential area for the intended application and choose its supported authentication method. Review the actual fields before requesting provider details. 2\. Name the connection for its app, environment and purpose. Store tokens/passwords only in the credential form. 3\. Select that connection explicitly in the test action. Enter the identifier of a record you are authorized to inspect. 4\. Run the read once and compare the returned ID and identifying field with the record in the target application. Confirm the account/environment as well as the content. 5\. If the connection authenticates but the wrong record/account is returned, correct the target mapping before broadening permissions or changing the credential. [Manage app and custom credentials](/userguide/integrations-and-api/manage-app-and-custom-credentials.md)