A skill can't reach its application until you add a credential — usually a single API token. RuneSpace collects it through a guided conversation, verifies it with one read-only call, and shows you the evidence.
Right after adding a skill from the gallery (or any time via the skill page), the connect conversation walks you through the credential: which token the app needs, and where to get it — each field links to the provider's own token page.
The value itself goes into a secure card: a masked input, one field per credential the skill declares (most apps need one token; Jira and Confluence also ask for the account email). The assistant will never ask for a key in chat — if you paste one into the conversation, it refuses it and points you at the card.
Note: Credentials are stored write-only in an encrypted vault. They never appear in chat and can't be read back — not by you, and not by the assistant.
The moment your credential is saved, RuneSpace runs one read-only operation against the live API and streams the result into the conversation as an evidence block: method, URL, HTTP status, and the response body.
On failure the secure card reopens so you can paste a corrected value. After two failed checks you'll also see "Finish anyway — I'll test it later" — the credential stays saved and you can retry any time in the skill's test chat.
When the check passes, the connection is proven and you're offered a first read to try.
Prefer a form? Do it manually takes you to the skill page's Credentials card:
The Credentials card lists each stored credential with its API domain, when it was added, and when it was last used.
Credentials are scoped to your workspace and shared by every skill that talks to the same API domain, so connecting GitHub once covers every GitHub skill you add.
