Integrations & Credentials

Praxis reaches the systems you run through two areas under Settings. Integrations are built-in connectors: you link an external system once for your whole organization, and every agent can then use it. Credentials are named secrets, such as API tokens and keys, that a custom tool or an MCP server references to reach a service Praxis has no built-in connector for. Both are scoped to your organization.

Integrations

The Integrations page lists the systems Praxis can connect to, grouped by category. Each connector shows whether it is Connected, still Available to set up, or marked coming soon. A connected card shows how many connections it holds and flags any that failed their last check, so a connection that needs attention is easy to spot.

📘

These are Praxis's own connections. Registering a cloud or Git account on your Facets control plane is a separate step in the control plane's settings, and Praxis can reuse a Git account already set up there. See Integrating cloud accounts and Integrating Git accounts.

Here is what you can connect today and what each type lets agents do:

Category	Connects to	What agents can do with it
Cloud	AWS, GCP, Azure	Query resources, investigate incidents, and find cost waste across your accounts
Kubernetes	Kubernetes	Inspect clusters and their workloads
Repositories	GitHub, GitLab, Bitbucket	Read code, open pull requests, and build a repository knowledge base
Chat	Slack, Mattermost, MS Teams	Post notifications and let you run Praxis from a channel
Observability	New Relic	Query application performance data, logs, traces, and alerts
Platform	Facets	Drive the Facets control plane in scheduled and autonomous runs

Alerting connectors for PagerDuty and Opsgenie are marked coming soon. You connect each integration once for the organization; to limit which ones a given agent can reach, scope them when you build the agent.

Connect an integration

Connecting follows the same shape for every category:

Open Settings > Integrations and select the system you want to connect.
Provide that provider's access in the setup panel. This is an access role for a cloud account, an access token for a Git host or an observability tool, a cluster config for Kubernetes, or a one-click sign-in or app install for Slack and GitHub.
Save, then run Test to confirm the connection works before an agent relies on it.

A connection belongs to your organization: anyone on your team can use it, and the person who added it can edit or remove it. To change the secret behind a connection, reconnect it from the same card.

Cloud accounts and Git hosts need provider-specific setup, such as creating an access role or installing the shared Facets GitHub App, and those steps match the ones the Facets platform uses (linked above). Once a repository is connected, see Repositories for building its knowledge base, and Cloud operations and cost for what agents do with a cloud account.

Credentials

An integration is a built-in connector; a credential is a secret you supply for everything else. When a custom tool or an MCP server needs to authenticate to a service, it references a stored credential by name instead of holding the secret itself. In a server's headers or environment, that reference reads as ${credential:name}, and Praxis substitutes the real value on the server each time the tool runs. See Connect a Tool for setting up those servers and tools.

You do not add credentials by hand on this page. Each one is created when an agent asks for it during a conversation, described below. A credential is either Personal, usable only by you, or Organization, shared with your whole team. When a tool runs, Praxis uses your Personal credential of that name if you have one, and otherwise the Organization one. Scheduled runs, Slack, and incident investigations act under no personal identity, so they can use only Organization credentials.

Provide a credential when an agent asks for one

When an agent reaches a service it has no credential for, it pauses and opens a Provide Credential panel that names the service, explains why it needs the secret, and gives step-by-step guidance for creating it. To supply it:

Create the token in the target service, following the panel's guidance. Select Ask Praxis for Help to work through it in a guided chat.
Paste the value into the credential field, using the show and hide control to check it.
Choose Personal or Organization scope.
Submit.

The agent never receives the value you paste. It works only with the credential's name, so the secret stays out of the conversation, out of the model, and out of the logs.

Manage and remove credentials

Open Settings > Credentials to review the credentials you can see, searched by name or service and filtered by scope. Each entry shows its service, scope, owner, and when it was created and last used. Only a credential's owner can edit it, to replace the stored value or update the description, and the value is never shown back, even to the owner.

Removing a credential is permanent and breaks anything still using it. If any MCP servers reference the credential, Praxis lists them and blocks the deletion; you can still choose Force Delete to remove it and knowingly break those servers. Either way, you confirm by typing the credential's name.

🚧

Deleting a credential cannot be undone. It removes the encrypted value and affects every user and agent that relied on it, which for a shared Organization credential is your whole team. Check what depends on it first.

How integrations and credentials stay secure

Every integration and credential is protected the same way:

Encrypted and server-side. Secrets are stored encrypted and resolved only on the server at run time. They are never shown back to you, sent to the model, or written to logs.
Scoped to your organization. A connection or credential is visible only inside the organization that created it, so one organization's secrets never surface in another's session.
The scope you choose. A Personal credential stays yours. An Organization credential, like any integration, can be used by every member of your organization and by the autonomous agents they run, so share one only when you intend to.
Read before change. Connecting a system gives agents a way to act through it, but Praxis stays read-only until you approve a change.

For where Praxis runs and how it isolates each run, see How Praxis works and stays safe.

Connect a Tool - Add MCP servers and custom tools that reference your credentials
Repositories - Connect a Git repository and build its knowledge base
Cloud operations and cost - What agents do with a connected cloud account
How Praxis works and stays safe - The execution, encryption, and tenant-scoping model
Integrating cloud accounts - Connect a cloud provider account on the Facets platform
Integrating Git accounts - Connect a Git host on the Facets platform