6. Credential Request

Credential Request Call

Outcome: Client understands how to obtain each credential type; all credentials collected and stored securely in 1Password Trigger: Onboarding Call complete, before AI Roadmap Call Duration: 90 min total (15 min prep + 60 min call + 15 min post-call)

Quick Reference

Step	Action	Time
Pre-Call
1	Generate credential list from proposal	5 min
2	Create client 1Password vault	2 min
3	Send prep email	3 min
4	Pre-call setup	5 min
60-min Call
5	Intro & agenda	5 min
6	Security overview & delivery methods	10 min
7	Walk through OAuth credentials	20 min
8	Walk through API keys & passwords	20 min
9	Wrap-up & next steps	5 min
Post-Call
10	Send thanks email	1 min
11	Store all credentials in 1Password	5 min
12	Test all credentials in n8n	5 min
13	Send confirmation OR correction email	5 min

Purpose: Walk the client step-by-step through obtaining each credential type. Testing happens AFTER the call — any issues are resolved via email with clear instructions.

---

1Password Vault Architecture

Each client gets their own dedicated vault in 1Password. This keeps credentials organized, makes access control simple, and allows clients to optionally view their own stored credentials.

Vault Structure

The Entourage AI (1Password Account)
├── Private (personal vault)
├── Shared (internal team)
├── TEAI - Internal Tools
└── Client Vaults
    ├── NADD - Nadia's Boutique
    ├── CRFG - Craft Goods Co
    ├── MSBR - Melbourne Spark Bros
    └── {CODE} - {Client Name}

Naming Convention

Element	Format	Example
Vault name	{CODE} - {Client Name}	NADD - Nadia's Boutique
API credentials	{Platform} API Key	Stripe API Key
OAuth credentials	{Platform} OAuth	HubSpot OAuth
Service accounts	{Platform} Service Account	Google Service Account
User/pass logins	{Platform} Login	Xero Login

Permission Levels

Role	Access	When to Use
View Items	See credentials, copy values	Client guest access (optional)
Edit Items	Create, modify, delete	Team members working on client
Manage Vault	Grant/revoke access	Account admins only

Creating a Client Vault

1. Go to 1Password.com → Vaults → New Vault

2. Name: {CODE} - {Client Name} (e.g., NADD - Nadia's Boutique)

3. Description: Credentials for {Client Name} automation workflows

4. Icon: Use client's industry icon or default folder

5. Click Create Vault

Adding Team Members

1. Open the vault → People → Manage

2. Add team members assigned to this client

3. Set permission to Edit Items (not Manage)

4. They'll see the vault on their next sync

Optional: Client Guest Access

If the client wants visibility into their stored credentials:

1. Open the vault → People → Invite

2. Enter client's email

3. Set permission to View Items only

4. Client receives email invitation

5. They create a free 1Password guest account

6. After accepting, they can view (not edit) their credentials

Note: Guest accounts can only access ONE vault, which is why we use one vault per client.

---

Full Guide

Pre-Call Prep (15 min)

Generate Credential List (5 min)

Review the proposal to identify all systems that will need integration:

/prepare:credential-list {CODE}

This generates a checklist of:

• Platform name

• Credential type (OAuth2, API key, user/pass)

• Required permissions

• Delivery method recommendation

Common systems from proposals:

• Email: Gmail, Outlook

• CRM: HubSpot, Salesforce, Pipedrive

• Accounting: Xero, QuickBooks

• Communication: Slack, Teams

• File storage: Google Drive, Dropbox

• Custom: Client-specific APIs

Create Client 1Password Vault (2 min)

If this is a new client, create their vault now:

1. Go to 1Password.com → Vaults → New Vault

2. Name: {CODE} - {Client Name}

3. Description: Credentials for {Client Name} automation workflows

4. Add yourself and any team members assigned to this client

5. Permission: Edit Items

Skip if: Vault already exists from a previous engagement.

Send Prep Email (3 min)

/create:email {CODE} --type credential-prep

Send 24-48 hours before the call so client can:

• Review what's needed

• Identify who has admin access

• Choose their preferred delivery method

Pre-Call Setup (5 min)

Open:

• Client folder

• Proposal (credential list)

• n8n instance

• 1Password vault for this client ({CODE} - {Client Name})

• Call recording software

Verify 1Password vault exists: If not created in step above, create now before call.

---

Call Structure (60 min)

Section 1: Intro & Agenda (5 min)

"Thanks for jumping on! Today I'm going to walk you through how to get all the credentials we need for your automation. I'll show you exactly where to find everything — it's like a guided tour of your platforms' settings. Should take about an hour."

Set expectations:

• This is educational — you'll see exactly what we need and why

• Share your screen when we get to your platforms

• I'll note everything down; you don't need to remember the steps

• After the call, I'll test everything and email you confirmation

Section 2: Security Overview & Delivery Methods (10 min)

Explain our security approach:

• "All your credentials are stored in a dedicated 1Password vault just for your company"

• "No one else can access your vault — it's completely separate from other clients"

• "You can optionally have view-only access to see what's stored"

Present the two delivery methods:

Option A: OAuth Authorization (Recommended)

• You authorize our app directly in the platform

• You maintain full control — revoke anytime with one click

• Best for: Gmail, Slack, HubSpot, Xero, Google Drive

• "Think of it like giving us a house key you can deactivate anytime"

Option B: API Keys & Passwords (for platforms without OAuth)

• You create a dedicated API key or user account

• We store it securely in your 1Password vault

• Best for: Stripe, custom APIs, legacy systems

• "We never ask for your personal password — always a dedicated key"

If client is nervous about access:

• "You can remove our access anytime with one click"

• "We only access data needed for the workflow"

• "Everything is logged — you can see exactly what we do"

If client says "We can't share that":

"I completely understand the concern. Here's how we handle security: your credentials are stored in a dedicated 1Password vault that no one else can access — it's just for your company, completely separate from every other client. Only myself and the team assigned to your project can see it. It's really important we get this credential because the platform's API requires it for the automation to work. Without it, we won't be able to connect to {Platform} and that part of the workflow won't function. Is there someone from your IT team we should loop in to discuss security requirements?"

Section 3: Walk Through OAuth Credentials (20 min)

Go through each OAuth platform one by one. The goal is to SHOW the client how to authorize, not rush through it.

For each OAuth platform (Gmail, HubSpot, Slack, etc.):

1. Explain what we're connecting: "First, let's connect Gmail so we can trigger workflows from emails."

2. Have client share their screen

3. Guide them to the authorization:

   • "Go to {platform URL}"

   • "Click Settings → Integrations → API Access"

   • "You'll see an 'Authorize' button..."

4. Walk through the OAuth flow:

   • "Click 'Sign in with {Platform}'"

   • "Review the permissions — here's what each one means..."

   • "Click 'Allow'"

5. Confirm success: "Perfect, you should see a confirmation screen."

6. Note the credential for post-call setup: Document platform name, auth method, any notes.

Pace yourself: Spend 3-5 minutes per platform. Don't rush — this builds trust.

Section 4: Walk Through API Keys & Passwords (20 min)

For platforms without OAuth, guide the client through creating API keys or service accounts.

For each API key platform:

1. Explain what we need: "For Stripe, we need an API key. Let me show you exactly how to create one."

2. Have client share their screen

3. Guide them to API settings:

   • "Go to your Stripe Dashboard"

   • "Click Developers → API Keys"

   • "You'll see 'Secret Key' — that's what we need"

4. Help them create the key:

   • "Click 'Create Restricted Key'"

   • "Name it 'Entourage Automation'"

   • "Set these permissions: [read charges, read customers, etc.]"

5. Securely capture the key:

   • Have them copy and paste into the Zoom chat (or use 1Password share link)

   • Immediately delete from chat after you've captured it

   • Or have them send via 1Password share link post-call

6. Note for post-call: Document platform, key name, permissions granted.

For user/password credentials (legacy systems):

• Guide them to create a dedicated "service account" user

• Never ask for their personal login

• Document: username, how password will be shared (1Password link)

Common platform guides to reference:

Platform	Where to find API keys
Stripe	Dashboard → Developers → API Keys
Xero	Developer Portal → My Apps → New App
QuickBooks	Intuit Developer → My Apps → Keys
Shopify	Settings → Apps → Develop Apps
Mailchimp	Profile → Extras → API Keys

Section 5: Wrap-Up & Next Steps (5 min)

"Excellent work! We've got everything we need. Here's what happens next:"

1. Immediately after this call: I'll store all credentials securely in your 1Password vault and test each connection

2. Within 2 hours: You'll get an email confirming everything works — or if there's an issue, I'll include exactly how to fix it

3. AI Roadmap Call on {date}: We'll dive deep into your processes

"If any credential doesn't work, don't worry — I'll email you the exact steps to fix it. No need to jump on another call."

"Any questions before we wrap?"

---

Post-Call (15 min)

Step 0: Send Thanks Email (1 min)

Immediately after hanging up, send the credential-thanks email:

/create:email {CODE} --type credential-thanks

This lets the client know you're on it and sets expectations for follow-up.

Step 1: Store Credentials in 1Password (5 min)

For each credential collected during the call:

1. Open the client's vault: {CODE} - {Client Name}

2. Create a new item for each credential:

Credential Type	1Password Item Type	Fields to Fill
API Key	API Credential or Password	Name, key value, permissions, created date
OAuth Token	Login	Platform, auth method, authorized scopes
User/Password	Login	Username, password, URL, notes

1. Add notes to each item:

   • Permissions granted

   • Who created it (client contact name)

   • Date obtained

   • Any special instructions

Naming convention in 1Password:

• {Platform} API Key — e.g., Stripe API Key

• {Platform} OAuth — e.g., HubSpot OAuth

• {Platform} Login — e.g., Xero Service Account

Step 2: Test Credentials in n8n (5 min)

For each credential:

1. Go to n8n → Credentials → Create New

2. Select the platform

3. Paste credentials from 1Password

4. Click Test

5. Record result: ✅ Verified or ❌ Failed + error message

Common test failures:

Error	Likely Cause	Fix (include in email)
401 Unauthorized	Wrong API key or expired	Ask client to regenerate key
403 Forbidden	Missing permissions	Ask client to add required scopes
Connection refused	IP whitelist blocking	Ask client to whitelist n8n IP
Invalid token	OAuth flow incomplete	Schedule 5-min follow-up to re-auth
Rate limited	Too many requests	Wait and retry in 15 minutes

Step 3: Send Email (5 min)

Based on test results, send ONE of these emails:

If ALL credentials work: Send credential-confirmation email If ANY credential fails: Send credential-correction email

---

Document in settings.json

{
  "onePassword": {
    "vault": "{CODE} - {Client Name}",
    "clientGuestAccess": false
  },
  "credentials": [
    {
      "name": "{CODE}-Gmail-OAuth2",
      "type": "OAuth2",
      "status": "verified",
      "tested": "{DATE}",
      "deliveryMethod": "oauth",
      "onePasswordItem": null
    },
    {
      "name": "{CODE}-HubSpot-OAuth2",
      "type": "OAuth2",
      "status": "verified",
      "tested": "{DATE}",
      "deliveryMethod": "oauth",
      "onePasswordItem": null
    },
    {
      "name": "{CODE}-Stripe-API",
      "type": "API Key",
      "status": "verified",
      "tested": "{DATE}",
      "deliveryMethod": "1password",
      "onePasswordItem": "Stripe API Key"
    }
  ]
}

Create Call Notes

Save to: clients/{kebab-name}/context/calls/credential-call-{DATE}.md

# Credential Request Call - {Client Name}
Date: {DATE}
Attendees:

## Credentials Configured
| Platform | Name | Status | Notes |
|----------|------|--------|-------|
| Gmail | {CODE}-Gmail-OAuth2 | ✅ Verified | |
| HubSpot | {CODE}-HubSpot-OAuth2 | ✅ Verified | |

## Pending Credentials
| Platform | Owner | Deadline | Blocker |
|----------|-------|----------|---------|
| {Platform} | {Name} | {Date} | {Reason} |

## Notes
{Any issues, concerns, or follow-ups}

Send Confirmation Email

/create:email {CODE} --type credential-confirmation

---

Handling Pending Credentials

If any credentials couldn't be configured during the call:

1. Document the blocker — Why couldn't we get it? (No admin access, IT approval needed, etc.)

2. Assign an owner — Who is responsible for getting it?

3. Set a deadline — When do we need it by?

4. Send follow-up email — /create:email {CODE} --type credential-followup

Escalation timeline:

• Day 3: Follow-up email

• Day 5: Phone call

• Day 7: Escalate to sponsor/decision-maker

---

Handling Additional Systems (Post-Workshop)

Since this SOP runs before Workshop (SOP 7) and Development (SOP 8), additional systems may be discovered later.

During Workshop (SOP 7): If new systems are identified that weren't in the proposal:

• Note them in Workshop call notes

• Request credentials async via email (using credential-followup template)

• Or schedule a brief 10-min follow-up call if complex OAuth

During Development (SOP 8): Check if all required credentials are configured:

• If missing: Request immediately with deadline

• Update settings.json when received

This is rare since sales maps major integrations during the AI Roadmap sales process.

---

Credential Naming Convention

Platform	Naming Pattern	Example
Gmail	{CODE}-Gmail-OAuth2	NADD-Gmail-OAuth2
HubSpot	{CODE}-HubSpot-OAuth2	NADD-HubSpot-OAuth2
Slack	{CODE}-Slack-Bot	NADD-Slack-Bot
Xero	{CODE}-Xero-OAuth2	NADD-Xero-OAuth2
API Key	{CODE}-{Platform}-API	NADD-Stripe-API

---

Email Templates

credential-prep

When to send: 24-48 hours before credential call Command: /create:email {CODE} --type credential-prep

Subject: Credential Setup Call - Quick Prep Needed

Hi {Name},

Looking forward to our credential setup call on {Date/Time}!

This is a 60-minute working session where I'll walk you through connecting all the systems needed for your automation. Think of it as a guided tour of your platforms' settings — I'll show you exactly where to find everything. No technical knowledge required.

WHAT WE'LL CONNECT
Based on your project, we'll need access to:
{List from proposal - e.g.}
- Gmail (for email triggers)
- HubSpot (for CRM updates)
- Slack (for notifications)

BEFORE THE CALL
Please ensure you have:
- [ ] Admin access to the systems above (or have someone with access available)
- [ ] 5 minutes to review this email

HOW WE'LL DO IT
You have two options for sharing access:

**Option A: Add Us to Your Account** (Recommended)
You add our service account to your platform. You keep full control and can revoke access anytime.

**Option B: Secure Password Sharing**
You create a dedicated user/API key and share via our encrypted 1Password vault.

Most clients prefer Option A — we can discuss which works best for you on the call.

SECURITY NOTE
- Your credentials are stored in a dedicated 1Password vault that only your project team can access
- Each client has their own separate vault — your data is never mixed with others
- You can optionally have view-only access to see exactly what's stored
- You can revoke access at any time

Questions? Just reply.

See you on {Date}!

Cheers,
{Your Name}
AI Solutions Engineer
The Entourage AI

---

credential-thanks

When to send: Immediately after call ends (within 5 minutes) Command: /create:email {CODE} --type credential-thanks

Subject: Thanks {Name}! Testing Credentials Now

Hi {Name},

Thanks so much for jumping on that call! Really appreciate you walking through all the systems with me.

I'm now going to:
1. Store everything securely in your 1Password vault
2. Test each credential to make sure it connects properly

If everything works, I'll send you a quick confirmation email. If anything needs a tweak, I'll email you the exact steps to fix it — no need for another call.

You should hear back from me within the next couple of hours.

Chat soon!

{Your Name}
AI Solutions Engineer
The Entourage AI

---

credential-confirmation

When to send: Within 2 hours of credential call, ONLY if all credentials tested successfully Command: /create:email {CODE} --type credential-confirmation

Subject: Credentials Configured ✅

Hi {Name},

Great session today! I've tested all the credentials and everything is working perfectly.

CREDENTIALS CONFIGURED
{List each credential - e.g.}
✅ Gmail - Connected via OAuth
✅ HubSpot - Connected via OAuth
✅ Stripe - API Key verified

All credentials are stored securely in your dedicated 1Password vault.

WHAT'S NEXT
Your AI Roadmap Discovery call is on {Date}. We'll dive deep into your processes and pain points.

With credentials already set up, we can hit the ground running when development starts!

Questions? Reply anytime.

Cheers,
{Your Name}
AI Solutions Engineer
The Entourage AI

---

credential-correction

When to send: Within 2 hours of credential call, when one or more credentials failed testing Command: /create:email {CODE} --type credential-correction

Subject: Quick Fix Needed - {Platform} Credential

Hi {Name},

Thanks for your time on our credential call! I've tested everything and most credentials are working great.

WORKING ✅
{List working credentials - e.g.}
✅ Gmail - Connected via OAuth
✅ HubSpot - Connected via OAuth

NEEDS ATTENTION ⚠️
The {Platform} credential didn't connect successfully. Here's exactly how to fix it:

ISSUE: {Brief description - e.g., "The API key doesn't have the required permissions"}

HOW TO FIX:
{Step-by-step instructions tailored to the specific platform and error}

1. Log in to {Platform} at {URL}
2. Go to {Settings → API Keys / Developer Settings / etc.}
3. {Specific action - e.g., "Create a new API key with the following permissions:"}
   - {Permission 1}
   - {Permission 2}
4. Copy the new key
5. Reply to this email with the new key (or share via 1Password link: {link})

WHY THIS IS NEEDED
{Brief explanation - e.g., "Without the 'read_customers' permission, we can't pull customer data into your workflow."}

Once I receive the updated credential, I'll test it and confirm everything's working.

No need to schedule another call — just reply to this email and I'll handle the rest!

Cheers,
{Your Name}
AI Solutions Engineer
The Entourage AI

Tips for writing correction emails:

• Be specific about the exact error

• Provide step-by-step fix instructions with screenshots if helpful

• Explain WHY the credential is needed (builds urgency)

• Make it easy to reply — don't require another call

---

credential-followup

When to send: 3 days after call if credentials still pending Command: /create:email {CODE} --type credential-followup

Subject: Quick Follow-Up - Pending Credentials

Hi {Name},

Just following up on the credentials we weren't able to configure during our call:

STILL NEEDED
⏳ {Platform} - {What's needed}
   Blocker: {Reason - e.g., "Waiting on IT approval"}
   Impact: {What we can't do without it}

HOW YOU CAN HELP
{Specific action - e.g.}
- Forward this to your IT team with approval request
- Let me know the admin contact and I can reach out directly
- Schedule a quick 10-min call with the person who has access

TIMELINE
We need this by {Date} to stay on schedule for your {Workflow Name} delivery.

Need help unblocking this? Happy to jump on a quick call.

Cheers,
{Your Name}
AI Solutions Engineer
The Entourage AI

---

Verify

Pre-Call

• 1Password vault created: {CODE} - {Client Name}

• Prep email sent 24-48h before call

• Credential list generated from proposal

Call (60 min)

• Call completed

• All credentials collected (OAuth authorized or API keys received)

• Client understands how each platform works

Post-Call

• Thanks email sent within 5 minutes of call ending

• All credentials stored in 1Password vault

• All credentials tested in n8n

• n8n credential naming follows convention: {CODE}-{Platform}-{Type}

• settings.json updated with credential details (including onePassword section)

• Call notes created

• Email sent within 2 hours:

  • If all passed: credential-confirmation email

  • If any failed: credential-correction email with fix instructions

• Any pending credentials have owners + deadlines

• (Optional) Client invited to 1Password vault with View access if requested

Next: Workshop