The Credentials panel is a webview in the Intellij SFCC activity-bar container. It is the single place where you store the secrets the extension needs: Business Manager accounts, WebDAV and OCAPI access keys, and OCAPI or SCAPI API clients. Everything is kept in one encrypted file that the extension reuses across every workspace you open, so you set a credential once and it is available everywhere
How It Works
The panel does not scatter secrets across workspaces or store them in dw.json. Instead it manages a single encrypted file and points the IDE at it
Sandbox 02
Unlink File
Delete File
- One encrypted file. All accounts, access keys, and API clients live in a single
.credsfile. The file is encrypted on disk, so its contents are unreadable without the secret key - A secret key unlocks it. When the file is created, the extension generates a secret key (the file password). The key is kept in VS Code's secret storage, which your operating system protects: the Keychain on macOS, DPAPI on Windows, and a keyring such as GNOME Keyring or KWallet on Linux. The encrypted file and the key are kept separate, so the file alone reveals nothing
- The path is global. The link to the file is saved in your global user settings, not in a single workspace. Every workspace you open on that machine reads the same file automatically
- Live re-sync. A file watcher reloads credentials the moment the file changes on disk, so edits appear without a manual refresh
Every workspace on the machine reads the same file, and so does a JetBrains IDE with Intellij SFCC linked to it, since both write the same encrypted format:
Hidden From AI Agents
Coding agents such as Codex and Claude Code read whatever files they can reach, inside your project and outside it. A dw.json hands them your sandbox password in plain text. Intellij SFCC never needs one, so an agent has no readable secret to pick up
- Ciphertext only. Account passwords, access keys, and API client secrets live in the encrypted
.credsfile. An agent that opens it, in your project or on a synced drive, finds only ciphertext - The key is never next to the file. The secret key that decrypts it is held in VS Code's secret storage, not in the
.credsfile, a settings file, or your project - B2C MCP reports status, not secrets. When an agent works through B2C MCP, connection tools return hostnames, code versions, masked usernames, and whether each credential is configured or missing, never the password, access key, or client secret itself
- No token in MCP configs. With MCP authentication on, the client configs the extension writes reference the access token through an environment variable, so the token itself is never saved in a config file
Sync to a JSON File writes the password and client secret into the file you link, in plain text, where any agent can read them. Leave it off in projects where agents work, and remove any hand-made dw.json. A client certificate passphrase is saved with its connection in VS Code's workspace state, not in the .creds file
Why This Model Helps
Storing credentials this way removes the usual pain of keeping secrets in sync
- Edit in one place, used everywhere. Update a password, add an access key, or rotate an API client secret once, and every workspace that points at the file picks up the change right away. There is no per-workspace copy to update
- No secrets in your repositories. Workspace folders never need a
dw.jsonor any secret file, so nothing sensitive is committed by accident - Sync across machines with a shared drive. Because it is a single file, you can keep it on an external shared or syncable drive such as iCloud Drive, Google Drive, Dropbox, or OneDrive. Your laptop and desktop then read the same credentials, kept in sync automatically by the drive. Each machine only needs the secret key entered once to unlock the file. Your Intellij SFCC license still runs on one of them at a time; see Devices
- Encrypted at rest. Even on a shared drive the file stays encrypted, and the secret key never travels inside it
The difference from keeping a secret file in every workspace:
Sync Across Machines
Put the .creds file on a synced drive and every machine reads the same credentials. Each machine keeps its own copy of the secret key in VS Code's secret storage, so the key never travels inside the file:
When you sync the file across machines, only the encrypted .creds file is shared. The secret key is stored in each machine's VS Code secret storage, so enter it once per machine when you link the file. Keep the secret key somewhere safe, because without it the file cannot be decrypted
Getting Started
Create and save the file
Choose Create B2C Credentials File, pick a folder, and give the file a name ending in .creds (for example sfcc-b2c.creds). The extension writes the encrypted file to that folder and links the IDE to it
Save the generated secret key
On creation, a secret key is generated automatically and copied to your clipboard. This key is the file password. Paste it somewhere safe, such as a password manager, because you will need it to unlock the file on another machine
Add an account
Add your Business Manager account with its username and password. Optionally add the sandbox hostnames this account uses
Add access keys and API clients
Add a WebDAV access key per sandbox for remote file access, and add any OCAPI or SCAPI API clients. See Access Keys and API Clients below
Reuse everywhere
Open any other workspace on the same machine and the credentials are already there. To use them on a second machine, put the .creds file on a synced drive, link it from the panel, and enter the same secret key
Accounts
An account represents a Business Manager login the extension authenticates with
- Username and password. The core fields for Business Manager and WebDAV access
- Hostnames. Optional sandbox hostnames you associate with the account so you can attach per-host access keys
- Actions. Each row has Edit, Copy for the username, Copy secret key for the password, and Delete. Copy secret key is disabled while the account has no password. In the editor, the eye button (Show secret, Hide secret) reveals the current password and Copy copies it
- State. The row reads Password set, or Incomplete when the account has neither a password nor an access key
An account needs either a password or a WebDAV access key for a hostname before it can be used for remote file access. The panel flags an account as incomplete when it has neither
Access Keys
Access keys are scoped secrets you can store per account and per hostname, as an alternative to the account password. In Business Manager a user can generate access keys from their profile settings instead of exposing the actual login password, and those keys can be revoked or rotated independently
Scopes
Each hostname can hold one key per scope:
| Scope | Used for |
|---|---|
| WebDAV | Code upload and remote file access over WebDAV |
| OCAPI | Stored for upcoming OCAPI features, not used by the extension yet |
| Storefront | Stored alongside the account, not used by the extension yet |
How the extension uses them
For WebDAV operations against a hostname, the extension prefers the WebDAV access key for that hostname when one is set, and falls back to the account password when it is not. This means you can keep BM passwords out of remote file access entirely by storing a WebDAV access key per sandbox
The script and pipeline debugger use the same WebDAV key or password. OCAPI and Storefront keys are only stored for now
How to add one
Generate the key in Business Manager
Open your account or profile settings in Business Manager and generate the access key for the scope you need (WebDAV, OCAPI, or Storefront). Copy the value
Add the hostname
In the panel, add the sandbox hostname to the account if it is not there yet
Save the access key
Add the key to the account by selecting the hostname and scope and pasting the value. Expand the hostname to see its keys: each has Show secret and Copy, and a scope without a key reads Not set
API Clients
API clients hold the credentials for OCAPI and SCAPI integrations. Connections reference them by client ID
OCAPI and SCAPI features are not available in the VS Code extension yet and are planned for upcoming updates. You can already save API clients here and link them to a connection under SCAPI / OCAPI
- Fields. A friendly name (optional), the client ID, the client secret, and a flag that marks the client as SCAPI rather than OCAPI
- Actions. Each row has Edit, Copy for the client ID, Copy secret key for the secret, and Delete, plus a SCAPI badge for a SCAPI client. In the editor, Show secret reveals the Current client secret, and the Client secret field takes a new one
- State. The row reads Secret set, or Incomplete when the client has no secret
Where a credential is used
An account or API client that a connection in the current workspace uses shows a usage badge, such as 3 uses. Click it to list the Connections using that record, and pick one to make it the active connection
The editor of an account or API client lists the same Connections, with Active on the active one. Click a row to focus that connection. Only connections from the current workspace are shown
Three filters narrow the lists: Used in connections, Filter by connection for the credentials of the connections you pick, and With access keys for accounts with at least one key. Clear filters removes them
Managing the File
The linked-file area at the top of the panel exposes the file lifecycle actions
| Action | What it does |
|---|---|
| Create | Generates a new encrypted .creds file and a secret key |
| Link | Points the IDE at an existing .creds file. You enter its secret key to unlock it |
| Sync | Manually reloads the file from disk |
| Reveal file | Opens the file in your system file explorer |
| Edit path | Changes which file the IDE is linked to |
| Edit secret key | Replaces the stored secret key |
| Unlink | Disconnects the IDE from the file without deleting it |
| Delete | Sends the file to the operating system trash and unlinks it |
Secret values are always masked in the UI and revealed only on demand
The Secret key card shows the stored key masked, with Show secret and Edit secret key, which opens the Credentials secret key dialog. Right after Create, a banner offers Copy secret key to copy the generated key again
Deleting the credentials file sends the linked file to the operating system trash when possible. Unlinking only disconnects the IDE from the file and leaves it on disk