Credentials System Deep Dive

How credential resolution works — three-tier hierarchy, Secure Vault, BYOK, and API cost tracking.

Written By Philippe

Last updated 3 days ago

Credentials System Deep Dive

indie.money's credential system has three tiers. Understanding how they interact helps both Builders and Producers configure workflows correctly.

Three-Tier Resolution Chain

When a workflow runs, credentials are resolved in this order:

Builder-provided — When the Builder pre-configured a credential, that key runs and its cost multiplier applies. You cannot override it.
Your own keys (Producer/BYOK) — Used when the Builder set none. You control your API usage and rate limits directly.
Platform-provided — indie.money provides built-in credentials for certain services. Fallback when the above are unavailable.

Secure Vault

All credentials are stored in the Secure Vault. Key properties:

Encrypted at rest and in transit
Decrypted only at execution time
Supports API key, OAuth 2.0, and Basic auth
OAuth tokens are refreshed automatically

BYOK (Bring Your Own Keys)

Producers who provide their own API keys are using BYOK mode. This is the most flexible option — you control your API usage and rate limits directly.

API Cost Tracking

Every provider has a cost model that determines how its API costs are tracked:

Cost Model	How It Works	Examples
Tracked	Actual cost parsed from API response	OpenRouter, OpenAI
Fixed	Declared per-call cost from registry (`$0.00` when unknown)	Twilio ($0.0079), SendGrid ($0.001); DeepL, Google Translate, Telegram, Slack, Discord (`$0.00`)

When a Builder pre-configures cost-bearing credentials (tracked, fixed, or variable) with an Who Pays for AI Usage?, the system:

Records the API cost for each call (actual from response, or declared from registry)
Enforces the cost ceiling across all cost types, so a run can never exceed the maximum shown before it starts
Bills the Producer according to the workflow's pricing mode, never above that maximum
Returns anything held but unused within minutes

Messaging APIs without a registered per-call cost (Telegram, Slack, Discord) have a $0.00 declared cost and produce no charge.

Credential Isolation

Credentials are scoped per workflow. A Producer's credentials for Workflow A cannot be accessed by or mixed with Workflow B — even if both workflows use the same external service.

Security Audit Trail

All credential access is logged. Builders cannot see Producers' credential values.

Was this helpful?

Still need help? Ask the team