en How to Configure API Credentials

How to Configure API Credentials

API Credentials are what Arthur attaches to every outgoing request when it calls your upstream API on behalf of a tool call. This is separate from Access Keys and OAuth Client, which protect incoming calls from an AI client to your MCP server — API Credentials is the outgoing side.

Prerequisites: a server already created, pointing at an upstream API.

Steps

1. Open the server and go to its Guard Rails tab (this is where API Credentials lives, despite the name of the tab).

   Open the capture server used by this procedure.

   

   Open the Guard Rails tab where the configuration is managed.

   

   Bring the API Credentials panel into view.

   

2. Choose the authentication type your upstream API expects:

   • Bearer Token — a single token sent as Authorization: Bearer <token>.
   • API Key — a parameter name and value, sent as either a header or a query parameter.
   • Basic Auth — a username and password.
   • OAuth2 Client Credentials — a token URL, client ID, client secret, and optional scope; Arthur fetches and refreshes the access token for you.
   • Custom headers — one or more arbitrary header name/value pairs.
   • None — no authentication added to upstream calls.

   Open the upstream API authentication type list.

   

   Select API Key to reveal its name, value, and transport fields.

   

   Set the parameter name sent to the upstream API.

   

   Open the available Secrets list without exposing values in the flow.

   

3. For any value field, reference a stored Secret with {{secret:NAME}} instead of typing the raw value.

   Highlight the first available Secret reference.

   

   Select the Secret reference for the credential.

   

   Open the API Key transport options.

   

   Configure the key as a query parameter to demonstrate the header alternative.

   

4. Save.

   Reopen the authentication list to restore the fixture.

   

   Return to None and remove the temporary credential from the capture server.

   

Confirm it worked

Test a tool on the server — the request Arthur sends upstream now carries the configured credentials, and calls that previously failed with a 401/403 from your API should succeed.

Good to know

• Don't confuse this with the Connect tab's Access Keys or OAuth Client — those authenticate the AI client calling your MCP server, not Arthur calling your upstream API. See Secrets and Authentication.
• The AI client never sees these credentials — they're attached server-side, invisible to the MCP contract.

Related

• Guard Rails
• How to Store and Reference a Secret