---
title: "Outbound Workflow Credentials - Documentation"
description: "Store API keys and bearer tokens as encrypted, write-only, destination-bound workflow credentials."
canonical: "https://www.aifordatabase.com/docs/outbound-credentials/"
---

# Outbound Workflow Credentials

advanced 6 min read

## Outbound Workflow Credentials

Workflow credentials authenticate an outbound webhook action to Brevo, Slack, a private API, or another HTTPS destination. They are separate from the `afd_` key used to call AI for Database.

### Permission boundary

Credential operations require:

1.  1An API key with the `workflow_credentials` scope
2.  2An organization admin role

### Create a destination-bound API key

```bash
curl -X POST \
  https://app.aifordatabase.com/api/v1/workflow-credentials \
  -H "Authorization: Bearer afd_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Brevo production",
    "kind": "API_KEY_HEADER",
    "allowedHosts": ["api.brevo.com"],
    "config": {
      "headerName": "api-key",
      "value": "provider-secret"
    }
  }'
```

Save the returned credential ID. The secret value is write-only and is not included in create, list, or read responses.

### Reference the credential

Use its ID in a version 2 webhook action:

```json
{
  "type": "WEBHOOK",
  "config": {
    "version": 2,
    "url": "https://api.brevo.com/v3/events/batch",
    "method": "POST",
    "credentialId": "WORKFLOW_CREDENTIAL_ID",
    "headers": [],
    "bodyMode": "JSON",
    "bodyTemplate": "{"events":{{query_1.rows}}}",
    "successStatusCodes": [202],
    "critical": true
  }
}
```

Inline authentication secrets are rejected. The requested destination must match an allowed host on the referenced credential.

### Rotation and deletion

*   Rotate the stored secret with `PATCH /api/v1/workflow-credentials/{id}`.
*   Read safe metadata with `GET /api/v1/workflow-credentials/{id}`.
*   Delete an unused credential with `DELETE /api/v1/workflow-credentials/{id}`.

Deletion is rejected when an active workflow still references the credential. Update or stop dependent workflows first.

### Network restrictions

Outbound webhook URLs must be public HTTPS destinations. Private and reserved networks, unsafe redirects, and unsupported destination ports are blocked. Host binding prevents a credential created for one provider from being sent to another host.

Source: https://www.aifordatabase.com/docs/outbound-credentials/