# Create and Manage MCP Credentials

Create MCP credentials in CloudFiles Settings so a service such as Agentforce can connect to the CloudFiles MCP server, copy the values the service needs, and revoke credentials you no longer use.

> Kind: Guide · Updated: Nov 4, 2026

MCP credentials let a service such as Agentforce connect to the CloudFiles MCP server without a person signing in. A CloudFiles admin creates them on the MCP Credentials page in CloudFiles Settings. Requests made with an MCP credential act as your CloudFiles account's system user, the same user CloudFiles Flow actions run as. AI apps such as Claude and ChatGPT do not use MCP credentials: each person signs in from the app, and the app acts as that person. This article shows how to create a credential, copy the values the service needs, and revoke a credential you no longer use.

## Create a credential

- In Salesforce, open the CloudFiles app.
- Select the Settings tab.
- Select MCP Credentials. The Client Credentials list shows the credentials in your CloudFiles account.

![The MCP Credentials page in CloudFiles Settings, with the Client Credentials list and the New Credential button.](https://media.help.cloudfiles.io/mcp-credentials-sf/01.png)

- Click New Credential.
- In Name, enter a name that says where the credential is used, for example Agentforce production. The name can be up to 100 characters.

![The New Client Credential window with a name entered.](https://media.help.cloudfiles.io/mcp-credentials-sf/02.png)

- Click Create. The Credential Created window shows four values, each with a copy button.

> **Copy the client secret now** — The client secret is shown only once. CloudFiles does not store the secret itself, so it cannot be shown again. If you lose the secret, create a new credential and revoke the old one.

![The Credential Created window with the Server URL, Identity Provider URL, Client ID and Client Secret, each with a copy button.](https://media.help.cloudfiles.io/mcp-credentials-sf/03.png)

- Copy each value into the service you are connecting, or store the client secret somewhere safe until you do.
- Click Done.

## The values you copy

| Value | What the service uses it for |
|---|---|
| Server URL | The address of the CloudFiles MCP server for your CloudFiles account's data region. The service connects to this address. |
| Identity Provider URL | The address where the service requests an access token with the client ID and client secret. |
| Client ID | Identifies the credential. It is not secret, and the credentials list shows it so you can match a service to its credential. |
| Client Secret | Proves the service holds the credential. Keep it private. |

CloudFiles credentials do not use scopes, so leave the Scope field empty when you register one, for example in Agentforce Registry. A value there is ignored. A credential can call every CloudFiles tool, and you choose which tools your agents may use in Agentforce Registry.

## Manage your credentials

The Client Credentials list shows the credentials in your CloudFiles account, newest first, with each credential's name, client ID, who created it and when, when it was last used, and its status. Last Used fills in after the service makes its first request. Select Show revoked to include revoked credentials, which stay in the list with the status Revoked as a record of what was connected.

### Revoke a credential

Revoke a credential when the service no longer needs it, or when its client secret may have been exposed.

- In the credential's row, open the row menu and select Revoke.
- In the Revoke credential? window, click Revoke.

Revoking stops every agent that uses the credential at once. Its client ID and client secret stop working, and a revoked credential cannot be restored.

![The Revoke credential? window.](https://media.help.cloudfiles.io/mcp-credentials-sf/04.png)

### Replace a client secret

A credential's client secret cannot be shown again or changed. To replace it, create a new credential, enter its values in the service, confirm the service works, and then revoke the old credential.

> **Use one credential per service** — Create a separate credential for each service that connects. Each credential works on its own: revoking one never affects the services that use the others.

## Verify the setup

The new credential appears in the Client Credentials list with the status Active. After the service connects and makes its first request, Last Used shows the time of that request. Next, connect Agentforce with the values you copied.