Skip to content
telemioDeveloper Docs
Open console
DOCUMENTATIONAuthentication · ReferenceBrowse integrations ↗
Docs/Authentication/Credentials and connected services
AUTHENTICATION · CREDENTIALS

Credentials and connected services

Different jobs use different credentials. Keep each one scoped to its intended purpose and storage location.

AI-READY REFERENCE

Pass this guide to your agent

Short, page-specific instructions for an AI coding assistant.

Markdown ↗
Preview agent instructions 
# Telemio agent instructions — Credentials and connected services

When designing a Telemio integration, distinguish user authentication, approved MCP OAuth credentials, workspace-scoped read tokens, server ingest keys, and browser-safe client ingest keys. Never use an ingest credential to read Telemio data or share one across organizations. Use least-privilege secret storage and explicitly authorized workspace membership. Treat Stripe Projects authorization as a separate integration flow; do not claim that Stripe credentials log users into Telemio. Validate scope, revocation, and minimal data export.

Reference: https://telemio.sh/docs/authentication/credentials.html

Credential types

CredentialPurposeHandling
User sessionSign in to TelemioCognito identity flow; check membership
MCP OAuth tokenAuthorized AI-client tool accessClient-managed OAuth and PKCE
Workspace read keyRead-only Developer Connect integrationPrivate credential manager
Server ingest keySubmit backend telemetryDeployment secret manager
Browser-safe keyCollect approved browser telemetryBrowser-safe only with its restrictions

Read-only automation

Use supported MCP connections or the read-only Developer Connect API for custom applications. Keep ingest credentials separate from read credentials.

Stripe Projects

Stripe Projects has its own approved connection and provisioning process; it does not replace Telemio sign-in or authorize access to unrelated workspaces. The Stripe Projects documentation is the source for its current capabilities and onboarding requirements.

Operational checklist

  • Give each credential the smallest scope necessary.
  • Store private tokens in a supported secret manager or connection vault.
  • Preserve workspace membership checks for all API reads and writes.
  • Rotate/revoke credentials when no longer needed.
  • Verify actual tool or API behavior rather than assuming a connection works.