# Credentials in Vault

> Keep third-party tokens and API keys in Supabase Vault, behind functions only the service role may call.

Source: https://bettersupabase.com/docs/blocks/credentials

`credentials` keeps third-party tokens and API keys in Supabase Vault, named
`bs:cred:<provider>:<name>`. The security definer functions
`credential_get`, `credential_set` and `credential_delete` are the only way
in, and only the service role may call them. `vaultCredentials()` from
`better-supabase/credentials` resolves credential references through them.

```bash
better-supabase add credentials
```

The [Credentials guide](/docs/extending/credentials) has the setup and the full reference.