Attach credentials to workflow nodes

You can attach credentials to workflow nodes so that automation orchestrator automatically provides authentication when the workflow runs.

When you configure a workflow node that connects to an external service, such as a REST API, an LLM provider, or an Ansible Automation Platform instance, you select a credential from the node's configuration panel. Automation orchestrator resolves that credential at execution time, decrypts the stored values, and injects them into the node's execution context without exposing them in logs or workflow definitions.

Each credential type is compatible with specific node types. The credential selector in the workflow builder filters available credentials by type so you can only attach a compatible credential to each node.

Attach a credential to a workflow node

When configuring a workflow node in the Builder, you can attach a credential to authenticate the node's external connections.

Procedure

  1. Open a workflow in the Builder.
  2. Select a node to configure (for example, a REST API action node or a Task Agent node).
  3. In the node configuration panel, locate the credential selector.

    The selector label and available credential types depend on the node type:

    Table 1. Node type credential compatibility
    Node type Selector label Compatible credential types
    REST API (Action) Authentication credential HTTP Bearer Token, HTTP Basic Auth
    Task Agent Model (then contextual credential status) LLM Provider
    AAP Job Execution Authentication credential Ansible Automation Platform

    For REST API and AAP Job Execution nodes, continue with selecting a credential from the dropdown. For Task Agent nodes, the credential flow is different. See Add a Task Agent step.

  4. Select a credential from the dropdown.

    Credentials are grouped by type.

  5. Optional: Click Create new credential at the top of the dropdown to create a credential inline without leaving the Builder.

    The new credential is created in the same project as the workflow and is automatically selected after creation.

    Important:

    Creating a credential requires the credential:create permission. The built-in roles that include this permission are Admin (system scope), Project-admin, and Project-user. To grant credential creation access, assign one of these roles or a custom role that includes the credential:create permission. See Control access with predefined roles.

Results

Note:

Disabled credentials appear in the selector but are marked as "(disabled)" and cannot be selected.