Credentials

Credentials allow your app to access external services (Google Sheets, Drive, etc.) on behalf of users through OAuth.

Declaring Credentials

Define in inf.yml:

1credentials:2  - key: google.sheets3    description: Access to read/write Google Sheets4    optional: false56  - key: google.drive7    description: Access to Google Drive files8    optional: true

Properties

Available Credentials

List all credential keys valid in inf.yml:

1belt app credentials list

Common Credentials

→ Credentials overview for setup guides (Google, Slack, Microsoft, Notion, Salesforce, Reddit, and more)

Accessing Credentials

OAuth Credentials

1import os, json23class App(BaseApp):4    async def setup(self, config):5        creds_json = os.environ.get("GOOGLE_OAUTH_CREDENTIALS")6        if creds_json:7            self.credentials = json.loads(creds_json)

Service Account

1from google.oauth2 import service_account23sa_json = os.environ.get("GOOGLE_SA_CREDENTIALS")4if sa_json:5    self.credentials = service_account.Credentials.from_service_account_info(6        json.loads(sa_json)7    )

Secrets vs Credentials

Check before run

Validate that your team has the secrets and credentials an app requires before calling POST /run:

POST /credentials/check

Requires credentials:read scope. Send the same secrets and credentials arrays from your app's inf.yml:

1curl -X POST https://api.inference.sh/credentials/check \2  -H "Authorization: Bearer inf_your_key" \3  -H "Content-Type: application/json" \4  -d '{5    "secrets": [{ "key": "OPENAI_API_KEY" }],6    "credentials": [{ "key": "google.sheets" }]7  }'

When requirements are missing, the response matches the 412 body from POST /run (satisfied: false and an errors array). See REST overview — Missing requirements.

Connect from the CLI

Connect native OAuth and service-account providers without the dashboard:

1belt credentials connect google2belt credentials connect slack3belt credentials disconnect google

For MCP connector servers, use belt mcp connect <slug> instead. List connected services with belt credentials list (belt creds and belt integrations are aliases).

When a provider supports multiple connection types (Google has OAuth at google and a separate service account at google-sa), use the provider key that matches the connection you need. Connect a Google service account from Vault → credentials (google-sa slug) or with belt credentials connect google-sa.

When you run an app or agent and requirements are still missing, the CLI prints the same errors[] categories with actionable commands — for example belt secrets set OPENAI_API_KEY <value> or belt credentials connect google.

→ CLI setup: Credentials · Credentials API

Best Practices

1. Request minimal scopes - use readonly if you only read
2. Clear descriptions - explain why access is needed
3. Handle missing gracefully - check if optional credentials exist
4. Test without - ensure app works without optional credentials

REST API

Programmatic connect, disconnect, and requirements checks:

→ Credentials API — POST /credentials, POST /credentials/check, MCP tool proxy

Next

→ Troubleshooting - Common issues and solutions