---
title: Obtaining credentials
slug: obtaining-credentials
docTags: 
createdAt: 2026-08-26T20:45:24.784Z
---

This guide explains how to obtain all the credentials and access needed for agent development. 

# Obtain credentials 

:::::WorkflowBlock
:::WorkflowBlockItem
**Get JFrog API token**

1. Go to [https://kyndryl.jfrog.io](https://kyndryl.jfrog.io/)
2. Log in with your Kyndryl SSO
3. Click your **User Profile** (top right corner) → **Edit Profile**
4. Under Authentication Settings, click **Generate an Identity Token**
5. Copy and save the generated token securely
:::

:::WorkflowBlockItem
**Repository access**

No separate TaaS or additional repository-access request is required to pull the Bridge Agent SDK. If your Kyndryl SSO account can sign in to JFrog, proceed directly with token generation and .netrc setup
:::

::::WorkflowBlockItem
**Configure .netrc**

1. Create or edit \~/.netrc:

```javascript
cat >> ~/.netrc << 'EOF'
machine kyndryl.jfrog.io
login your-email@kyndryl.com
password your-jfrog-api-token
EOF
chmod 600 ~/.netrc
```

:::Paragraph{listStyleType="disc" indent="2"}
Option A: OpenAI API key (local\_dev): For local\_dev mode, you need direct access to OpenAI.
:::

:::Paragraph{indent="2"}
**Option A: Personal OpenAI account**
:::

:::Paragraph{listStyleType="decimal" listRestartPolite="1" indent="2"}
Go to [https://platform.openai.com/api-keys](https://platform.openai.com/api-keys)
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="2"}
Sign in or create an account
:::

:::Paragraph{listStyleType="decimal" listStart="3" indent="2"}
Click **Create new secret ke**"
:::

:::Paragraph{listStyleType="decimal" listStart="4" indent="2"}
Copy and save the key (starts with sk-)
:::

:::Paragraph{listStyleType="disc" indent="2"}
Option B: Azure OpenAI (Kyndryl)
:::

:::Paragraph{indent="2"}
Contact your team lead for Kyndryl Azure OpenAI credentials.
:::

2. Configure environment

```javascript
OPENAI_API_KEY=sk-your-key-here
OPENAI_API_BASE=https://api.openai.com/v1
```
::::
:::::

# Bridge Platform credentials

For bridge\_dev and production modes, you need Bridge Platform access.

::::WorkflowBlock
:::WorkflowBlockItem
**Get Bridge Console access**

1. Request access to Bridge Console via your team lead or the KAIF onboarding team
2. Log in to the Bridge Console at your account-specific URL
:::

:::WorkflowBlockItem
**Create a service ID and get the SERVICE\_API\_KEY**

The SERVICE\_API\_KEY is not a personal API key — it is the key associated with a Service ID (a machine/service account) on the Bridge Platform. Your agent uses this key to authenticate with the Bridge Access Management service and get a bearer token.

How to create a Service ID:

1. Log in to the Bridge Admin Console for your account
2. Navigate to **Manage & Administer&#xA0;**→ **Access Management** → **Service IDs**)
3. Click **Create Service ID**
4. Fill in the details:
   - **Name**: A descriptive name (e.g., incident-enrichment-agent-dev)
   - **Description**: Purpose of this service ID
5. The platform generates a service API key; copy it immediately
6. Store it securely; this becomes your SERVICE\_API\_KEY env var

The key is shown only once at creation time. If you lose it, you must create a new Service ID. 
:::

:::WorkflowBlockItem
**Get account ID**

1. In Bridge Console, go to **Account** → **Settings** (or check the URL — the account ID is in the host name)
2. Copy your **Account ID** (e.g., 697afe33bc0bab35cc54f8ae)

The account ID also appears in the account-specific host URL. For example https\://kaiftestaccount-us-697afe33bc0bab35cc54f8ae.bridge.kyndryl.com
:::

:::WorkflowBlockItem
**Get KAIF host URL**

The KAIF\_HOST is the global Bridge Platform URL used for Bridge Access Management , LLM, audit, and other platform services. This is different from the account-specific URL.
:::
::::

| <font color="#f3f4f6">**Variable**</font> | <font color="#f3f4f6">**URL Pattern**</font>                                                                           | <font color="#f3f4f6">**Example**</font>                                                  |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| KAIF\_HOST (global)                       | &#x7B;&#x7B;global-instance}}https\://-&#x7B;&#x7B;region}}-&#x7B;&#x7B;global-id}}}}.bridge.kyndryl.com               | https\://globalkaiffvt-us-6997f3f1ffcf5c8001488dfc.bridge.kyndryl.com                     |
| BRIDGE\_MCP\_SERVER\_UR<br /> (optional)  | https\://&#x7B;&#x7B;account-name}}-&#x7B;&#x7B;region}}-&#x7B;&#x7B;account-id}}.bridge.kyndryl.com/kaif/v2/mcp/tools | https\://kaiftestaccount-us-697afe33bc0bab35cc54f8ae.bridge.kyndryl.com/kaif/v2/mcp/tools |

:::hint{type="info"}
In bridge\_dev mode the SDK automatically builds the MCP endpoint from KAIF\_HOST (&#x7B;&#x7B;KAIF\_HOST}}/kaif/v2/mcp/tools). You only need BRIDGE\_MCP\_SERVER\_URL if your MCP server lives on a different host than KAIF\_HOST.

Ask your KAIF platform admin for the correct KAIF\_HOST URL for your environment.
:::

# MCP server access

For MCP tools (ServiceNow, Bridge Data, etc.), the SDK auto-resolves the MCP endpoint from KAIF\_HOST in bridge\_dev mode. You only need BRIDGE\_MCP\_SERVER\_URL if your MCP server runs on a different host.

The MCP Server URL is account-specific:

https\://&#x7B;&#x7B;account-name}}-&#x7B;&#x7B;region}}-&#x7B;&#x7B;account-id}}.bridge.kyndryl.com/kaif/v2/mcp/tools

**Configure .env**

&#x20;Only needed if your MCP server URL differs from [KAIF\_HOST BRIDGE\_MCP\_SERVER\_URL](https://myaccount-us-abc123def456.bridge.kyndryl.com/kaif/v2/mcp/tools)

## MCP tool permissions

To use specific MCP tools, your account must have them provisioned. Run the [MCP discovery script](https://github.com/kyndryl-agentic-ai/bdg-sw-agents-development-guide/blob/main/docs/02-new-agent-development/05-mcp-tools-discovery.md) to see what's available for your account.

Common tools:

| <font color="#f3f4f6">**Tool**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Notes**</font> |
| ------------------------------------- | -------------------------------------------- | -------------------------------------- |
| servicenow\_search\_incidents         | Search ServiceNow incidents                  | Primary way to look up incidents       |
| servicenow\_get\_all\_incidents       | List ServiceNow incidents                    | Paginated, up to 100                   |
| servicenow\_create\_incident          | Create a new incident                        | All 4 fields required                  |
| bridge\_execute\_query                | Query Bridge Data Lake (Trino SQL)           | Most commonly used                     |
| bridge\_list\_tables                  | List available tables                        | Enabled by default                     |
| bridge\_list\_domains                 | List data domains                            | Enabled by default                     |

:::hint{type="danger"}
&#x20;Tools like servicenow\_get\_ticket and servicenow\_update\_ticket do not exist on the current MCP server. Always verify with the discovery script before writing agent code.
:::

## Langfuse tracing (optional)

For observability and tracing:

Get Langfuse credentials

1. Request Langfuse access from your team lead
2. Get your project credentials from Langfuse dashboard

**Configure .env**

```javascript
LANGFUSE_SECRET_KEY=sk-lf-... 
LANGFUSE_PUBLIC_KEY=pk-lf-... 
LANGFUSE_BASE_URL=https://cloud.langfuse.com
```