# Tool authentication and Secrets

Webhook Tools can authenticate with a Bearer token, Basic credentials, or a custom header. The credential itself belongs in the workspace Secret vault; the Tool stores only the Secret name and authentication mode.

## Choose an authentication mode

- **Bearer token** sends `Authorization: Bearer <secret value>`.
- **Basic** expects the Secret value in `username:password` form, encodes it, and sends an `Authorization: Basic ...` header.
- **Custom header** sends the Secret value under the configured header name. If no name is supplied, Operade uses `X-API-Key`.

Create the Secret under workspace Settings, return to the Tool editor, choose the mode, and select its Secret name. The Tool configuration and list show that name for diagnosis, but the secret value never appears in the Tool response, config, or conversation event.

![Workspace Tools list showing Bearer authentication through the DOCS_QA_SERVICE Secret](/docs/product/tool-secret-authentication.webp)

## Replace a credential and handle missing Secrets

A Secret cannot be updated in place, and a duplicate Secret name is rejected. To replace its value while keeping the name, first detach every dependent Tool, delete the old Secret, recreate a Secret with the same name and the new value, then reattach those Tools. This sequence is not atomic: its interruption window spans those separate steps, and calls that need the missing Secret fail validation before sending HTTP. Verify every reattached Tool after replacement.

If a Secret was deleted or its name is wrong, Operade stops before sending HTTP and returns a validation failure to the model instead of making an unauthenticated request.

Do not place credentials in the URL, parameter defaults, request headers, descriptions, or dynamic variables. Those fields may be visible to workspace users or runtime records.

## Verify without exposing credentials

Test the Tool with a harmless request and confirm the remote system received the expected authentication scheme. In Conversation detail, inspect the `tool_call` status under **[Activity](/docs/monitor/transcript-and-activity)**, but never paste a real token into support notes. If the remote service returns HTTP 401 or 403, verify the selected Secret name, its current value, and the expected mode.

Continue with [webhook configuration](/docs/tools/webhook) or [Tool troubleshooting](/docs/tools/troubleshooting).