External service integrations require credentials — API keys or OAuth tokens — to authenticate. This document covers how credentials are stored, configured, and used by tools.
Storage
Credentials are stored locally on your machine. There is no cloud storage, no remote transmission, and no syncing. When a tool calls an external API, the stored credentials authenticate directly with that service.
Configuration
Credentials can be configured two ways:
Ahead of time — Choose API → Service Credentials... from the main menu and enter the required credentials before creating or running tools.
On demand — When a tool runs and detects missing credentials, it opens the configuration dialog. Enter the credentials, and execution resumes if configuration succeeds.
The Credentials Dialog
API → Service Credentials... is the entry point for external-service credentials.
The dialog presents all 11 supported services: GitHub, Slack, Notion, ClickUp, Linear, Asana, Discord, HubSpot, Calendly, Stripe, and QuickBooks.
QuickBooks collects the Intuit client ID and secret, current access and refresh tokens, Realm ID, and whether the connection targets the sandbox. Initial Intuit authorization is a manual setup step. After that, ThinkForge refreshes the access token automatically and saves the rotated tokens.
n8n is not offered as a connected service in the beta. Tools call each service's API directly.
Headless Behavior
When tools run without a person present — from a trigger, Power Strip, the Chrome extension, or the Mobile Dashboard — there is no way to show a credentials dialog. If credentials are missing, the operation fails with an error naming the service that needs configuration.
Set up credentials before deploying a tool with API calls to any unattended surface.
Per-Service Credential Types
Each service uses a different authentication mechanism:
- GitHub — Personal Access Token, fine-grained or classic
- Slack — Bot Token via OAuth app installation
- Notion — Internal Integration Token
- ClickUp — API Token from app settings
- Linear — Personal API Key
- Asana — Personal Access Token
- Discord — Bot Token from the developer portal
- HubSpot — Private App Access Token
- Calendly — Personal Access Token
- Stripe — Secret Key. Restricted keys are recommended for production.
- QuickBooks — OAuth 2.0 client ID and secret, access token, refresh token, Realm ID, and sandbox selection
QuickBooks Token Renewal
QuickBooks requires the Intuit OAuth client ID and secret, current access and refresh tokens, company Realm ID, and sandbox selection.
A credential record created before automatic renewal existed may hold only an access token and Realm ID. The dialog reports the missing fields and requires you to complete them before the connection counts as configured.
For a complete connection, renewal works like this:
- If ThinkForge knows the access token expires within five minutes, it refreshes before sending the request.
- If it has no expiration information, it sends the current token. One unauthorized response triggers a refresh and one retry.
- Simultaneous QuickBooks tool runs are serialized, so a waiting run picks up a token another run already rotated rather than refreshing an old one.
- A successful refresh saves the latest access and refresh tokens without disturbing the other QuickBooks fields.
Initial Intuit authorization is still manual, and saving credentials does not test the connection. A revoked or expired refresh token requires authorizing QuickBooks again.
Security Principles
- Credentials are stored locally only. They are never sent to ThinkForge infrastructure.
- Each service's credentials are independent. Configuring GitHub does not affect Slack.
- Credentials are per-machine, not per-project. A configured service is available to all tools.
- The dialog requires every service-specific field before saving, but does not verify the values with the provider at save time. Authentication failures surface when an API operation runs.
- Removing a credential immediately stops all tools using that service from making API calls.