Credentials Panel
One encrypted credentials file for accounts, access keys, and API clients, shared across every workspace
The Credentials panel is a webview in the Intellij SFCC activity-bar container. It is the single place where you store the secrets the extension needs: Business Manager accounts, WebDAV and OCAPI access keys, and OCAPI or SCAPI API clients. Everything is kept in one encrypted file that the extension reuses across every workspace you open, so you set a credential once and it is available everywhere.
How It Works
The panel does not scatter secrets across workspaces or store them in dw.json. Instead it manages a single encrypted file and points the IDE at it.
- One encrypted file. All accounts, access keys, and API clients live in a single
.credsfile. The file is encrypted on disk, so its contents are unreadable without the secret key. - A secret key unlocks it. When the file is created, the extension generates a secret key (the file password). The key is stored in your operating system secret store, which is Keychain on macOS, Credential Manager on Windows, and the Secret Service on Linux. The encrypted file and the key are kept separate, so the file alone reveals nothing.
- The path is global. The link to the file is saved in your global user settings, not in a single workspace. Every workspace you open on that machine reads the same file automatically.
- Live re-sync. A file watcher reloads credentials the moment the file changes on disk, so edits appear without a manual refresh.
The encrypted file and its key stay separate, and every workspace on the machine reads the same file:
Two things, kept separate on your machine
Every workspace you open on the machine
Why This Model Helps
Storing credentials this way removes the usual pain of keeping secrets in sync.
- Edit in one place, used everywhere. Update a password, add an access key, or rotate an API client secret once, and every workspace that points at the file picks up the change right away. There is no per-workspace copy to update.
- No secrets in your repositories. Workspace folders never need a
dw.jsonor any secret file, so nothing sensitive is committed by accident. - Sync across machines with a shared drive. Because it is a single file, you can keep it on an external shared or syncable drive such as iCloud Drive, Google Drive, Dropbox, or OneDrive. Your laptop and desktop then read the same credentials, kept in sync automatically by the drive. Each machine only needs the secret key entered once to unlock the file.
- Encrypted at rest. Even on a shared drive the file stays encrypted, and the secret key never travels inside it.
The difference from keeping a secret file in every workspace:
Update one and the rest go stale. Secrets risk being committed.
Edit once, every workspace picks it up. Nothing lives in your repositories.
Sync Across Machines
Put the .creds file on a synced drive and every machine reads the same credentials. Each machine keeps its own copy of the secret key in its OS store, so the key never travels inside the file:
Every machine reads the same file
Edit a credential on Machine A, the drive syncs the file, and Machine B's watcher reloads it automatically. Only the encrypted file travels. The key never leaves either machine.
When you sync the file across machines, only the encrypted .creds file is shared. The secret key is stored in each machine's OS secret store, so enter it once per machine when you link the file. Keep the secret key somewhere safe, because without it the file cannot be decrypted.
Getting Started
Create and save the file
Choose Create B2C Credentials File, pick a folder, and give the file a name ending in .creds (for example sfcc-b2c.creds). The extension writes the encrypted file to that folder and links the IDE to it.
Save the generated secret key
On creation, a secret key is generated automatically and copied to your clipboard. This key is the file password. Paste it somewhere safe, such as a password manager, because you will need it to unlock the file on another machine.
Add an account
Add your Business Manager account with its username and password. Optionally add the sandbox hostnames this account uses.
Add access keys and API clients
Add a WebDAV access key per sandbox for remote file access, and add any OCAPI or SCAPI API clients. See Access Keys and API Clients below.
Reuse everywhere
Open any other workspace on the same machine and the credentials are already there. To use them on a second machine, put the .creds file on a synced drive, link it from the panel, and enter the same secret key.
Accounts
An account represents a Business Manager login the extension authenticates with.
- Username and password. The core fields for Business Manager and WebDAV access.
- Hostnames. Optional sandbox hostnames you associate with the account so you can attach per-host access keys.
- Actions. Add, edit the password, remove, copy the username or password, and reveal a masked value when you need to read it.
An account needs either a password or a WebDAV access key for a hostname before it can be used for remote file access. The panel flags an account as incomplete when it has neither.
Access Keys
Access keys are scoped secrets you can store per account and per hostname, as an alternative to the account password. In Business Manager a user can generate access keys from their profile settings instead of exposing the actual login password, and those keys can be revoked or rotated independently.
Scopes
Each hostname can hold one key per scope:
| Scope | Used for |
|---|---|
| WebDAV | Code upload and remote file access over WebDAV. |
| OCAPI | OCAPI calls that authenticate with an account-level key. |
| Storefront | Storefront level access stored alongside the account. |
How the extension uses them
For WebDAV operations against a hostname, the extension prefers the WebDAV access key for that hostname when one is set, and falls back to the account password when it is not. This means you can keep BM passwords out of remote file access entirely by storing a WebDAV access key per sandbox.
How to add one
Generate the key in Business Manager
Open your account or profile settings in Business Manager and generate the access key for the scope you need (WebDAV, OCAPI, or Storefront). Copy the value.
Add the hostname
In the panel, add the sandbox hostname to the account if it is not there yet.
Save the access key
Add the key to the account by selecting the hostname and scope and pasting the value. You can copy, reveal, or remove it later.
API Clients
API clients hold the credentials for OCAPI and SCAPI integrations. Connections reference them by client ID.
- Fields. A friendly name (optional), the client ID, the client secret, and a flag that marks the client as SCAPI rather than OCAPI.
- Actions. Add, edit the name, secret, or SCAPI flag, remove, copy the client ID or secret, and reveal a masked secret.
Managing the File
The linked-file area at the top of the panel exposes the file lifecycle actions.
| Action | What it does |
|---|---|
| Create | Generates a new encrypted .creds file and a secret key. |
| Link | Points the IDE at an existing .creds file. You enter its secret key to unlock it. |
| Sync | Manually reloads the file from disk. |
| Reveal | Opens the file in your system file explorer. |
| Edit path | Changes which file the IDE is linked to. |
| Edit secret key | Replaces the stored secret key. |
| Unlink | Disconnects the IDE from the file without deleting it. |
| Delete | Sends the file to the operating system trash and unlinks it. |
Secret values are always masked in the UI and revealed only on demand.
Deleting the credentials file sends the linked file to the operating system trash when possible. Unlinking only disconnects the IDE from the file and leaves it on disk.