Credentials, bindings, and grants
A credential stores provider authentication, a binding makes a host usable by an agent, and a grant is temporary approved access.
On this page
Know the three objects
| Console item | Meaning |
|---|---|
| Credential / Credentials | A provider API key or OAuth connection held by Sallyport for service calls. Its secret is never returned to the agent. |
| Binding / Bindings | The connection from that credential to a host, with the policy that governs calls. |
| Grant / Grants | Temporary access created after approval, with its own scope, use limit, and expiry. |
Connect your own HTTP API
Open Add a credential and choose “Custom API”. Enter the service’s HTTPS URL, choose its authentication method, and enter the key. This creates both a credential and an HTTP binding, without a catalog recipe.
| Authentication | What Sallyport supplies |
|---|---|
| Bearer | Authorization: Bearer … |
| X-API-Key | X-API-Key: … |
| Authorization token | Authorization: token … |
| Basic | The username and password in an HTTP Basic header. |
| Custom header / multiple headers | Named headers, each with its own stored value and optional prefix. |
| Query parameter | A stored key in the parameter the service expects, such as api_key. |
| JSON body / URL path | For HTTP APIs that expect the key in a JSON field or a path segment. Configure the JSON pointer or the segment with {{credential}}. |
Use a publicly reachable HTTPS URL, including the port when needed, such as https://api.example.com:8443/v1. Leave login details, query parameters, and fragments out of the URL. Configure public query parameters and default headers separately; put keys in the authentication fields. A path such as /v1 restricts the connection to that path. The agent calls the full service URL with http.request, including its port and path. Agents with “Only listed connections” need the connection selected in their settings.
Connect a saved catalog credential
After saving a catalog credential, choose “Connect service” on its page. Select the service host and workspace, then save the connection. You can also start from Bindings and select an existing credential. An agent can request access with sallyport.request_access; granting the request in Access requests creates the credential and binding together.
Choose access and policy deliberately
“Whole workspace” lets an agent use workspace connections; “Only listed connections” is an allowlist. Provisioning an access request adds the requesting explicit-scope agent to the new binding. Configure call handling in Policies, and review temporary approval access in Grants.
Rotate a provider key safely
Create a distinct new key with the provider first. In Sallyport, open the credential, choose “Rotate credential”, save the new value, and test a harmless call. Revoke only the old provider key after the test succeeds. Never revoke the key Sallyport is still using.