Configure a Connection with User Credentials

With user credentials, the administrator configures a shared connector and each user enters their own credentials. This method applies to services where each person has a separate key, Token, authCode, or personal URL.

Business Example: Share a Sales Analysis Skill and Access a Database with Personal Credentials

The sales team shares a sales analysis Skill for querying orders, analyzing customer purchasing behavior, and generating sales reports. Each sales representative handles different customers and business areas, so their database accounts have different access permissions. If a fixed username and password are embedded in the shared Skill, everyone queries data under the same identity, preventing access based on individual permissions.

An app connection that supports user credentials lets the team share the analysis workflow while retaining each person's data access identity. The administrator creates a shared database connector in the Admin Console, and sales representatives enter their own database usernames and passwords in the user interface. When a Skill queries data, the platform supplies the current user's configured credentials to MCP. MCP uses the corresponding account to access the database, then passes the query results to the Skill for analysis and report generation.

Administrator Configuration

The following example creates a “Sales Database” connector. All names, URLs, and configuration values are examples. The administrator enters the shared configuration and uses ${参数名} for the credential portions that differ for each person. Users then enter their actual values in the user interface.

Method 1: Configure MCP Manually

1. Open the creation page. In the Admin Console, go to Capability Center > App Connections, click New Connection, and select Configure MCP Manually.
2. Enter the connection information. Select the transport type according to the provider's instructions and set the other fields as needed.

This example assumes that the provider requires two Headers, X-DB-Username and X-DB-Password, to pass the database username and password. These names are examples; use the names specified by the provider.

Setting	Example	Instructions
Connector URL	https://mcp.example.com/sales-db/mcp	Replace this with the actual MCP service URL, not a direct database connection URL.
Headers (first row)	Name: X-DB-Username; Value: ${dbUsername}	Declare a personal username parameter for users to fill in.
Headers (second row)	Name: X-DB-Password; Value: ${dbPassword}	Declare a personal password parameter for users to fill in.

The system identifies two credential parameters: dbUsername and dbPassword.

Method 2: Configure MCP with JSON

Click New Connection, select Configure MCP with JSON, paste the following configuration, and replace the service URL and Header names with those required by the provider:

{
  "mcpServers": {
    "销售数据库": {
      "type": "streamable-http",
      "url": "https://mcp.example.com/sales-db/mcp",
      "headers": {
        "X-DB-Username": "${dbUsername}",
        "X-DB-Password": "${dbPassword}"
      }
    }
  }
}

Where:

• 销售数据库 is the connector name and can be changed.
• Replace url with the actual MCP service URL.
• Set type according to the provider's instructions. This example uses streamable-http; use sse for SSE.
• The field names in headers correspond to Header Name, and the field values correspond to Header Value. Use the Header names required by the provider and leave personal values as ${参数名}.

If the Service Requires Another Personal Credential Format

The following are alternative formats that other services may require. Do not enter them together with the database example. For manual configuration, replace the corresponding Headers. For JSON configuration, replace the names and complete values in headers accordingly.

Service Requirement	Header Name	Header Value
Bearer Token	Authorization	Bearer ${userToken}. Keep the single space after Bearer.
API Key	The name specified by the provider, such as X-API-Key	${apiKey}
Key and Secret passed as separate Header values	Enter each provider-specified name on a separate line, such as X-API-Key and X-API-Secret	Enter ${apiKey} and ${apiSecret} separately. This only applies to services that accept directly passed values.
Basic Auth	Authorization	Basic ${basicValue}. Users must enter an already Base64-encoded credential value. Automatically encoding a username and password entered separately is not supported.

If the Service Provides Personal URLs

For example, a CRM service provides each sales representative with a URL containing a personal authCode. The administrator keeps the shared URL and replaces only the personal credential portion with ${authCode}:

• Manual configuration: Enter https://mcp.example.com/crm/mcp?authCode=${authCode} in Connector URL. You can click + Credential Parameter to insert a parameter, then change its name.
• JSON configuration: Set url to the same URL: "url": "https://mcp.example.com/crm/mcp?authCode=${authCode}".
• If the credential is in the URL path, replace it in the same position, for example, https://mcp.example.com/${accessKey}/mcp.

Configure Headers according to the service's integration instructions. If only URL credentials are required, leave Headers blank and omit headers from the JSON. Do not keep the two Headers from the database example above. Users only need to enter the corresponding parameter values, not the complete URL.

Test and Save

After completing either configuration method, click Test Connection, confirm that the system identifies the connection as Custom Credentials (User Credentials), and check the parameter names. The administrator's test only verifies server reachability; it does not mean that personal credentials have been successfully verified. After the test passes, follow the page instructions to save, confirm that the connector is enabled, and check that its authentication method is displayed as User Credentials in the list.

User Instructions

1. Find the app connection. Find “Sales Database” under Capability Center > App Connections > Enterprise App Connections. Before credentials are configured, its status is Pending Credential Configuration.
2. Enter your credentials. Click Credential Configuration and configure your personal credentials.
3. Connect and use. Once successful, the status changes to Connected and the connection is ready to use.