Placeholders Reference: Injecting Context Into Your Tools and Mates

Every placeholder available in allmates.ai — member identity, personal connectors, tool credentials, attachments and Mate instruction variables — with where each one works and how to fix the errors they raise.

Last updated 15 days ago

Placeholders let you write a configuration once and have allmates.ai fill in the right value at runtime — the person who triggered the tool, their organization, their personal credentials, the file they just attached.

A placeholder looks like this:

{{member.email}}

When a Mate calls a tool, every placeholder found in that tool's configuration is replaced by its real value before the request leaves the platform. Nothing is stored resolved: the substitution happens per call, for the person who made the request.

Where placeholders work

SurfaceWhat you can use it for

Tool credentials

API keys, tokens, account identifiers

Configured headers

Authorization, tenant headers, X-User-Email…

OpenAPI schema (custom REST tools)

Base URLs, path segments, default parameters

Tool call arguments

Values you want forced, whatever the Mate decides to send

MCP server URL

Per-tenant or per-customer endpoints

MCP credentials and headers

Authentication for remote MCP servers

Mate instructions

System-prompt variables only — see Mate instruction variables below

Spaces inside the braces are tolerated: {{ member.id }} works exactly like {{member.id}}.

Note for older tools. Custom REST tools created before the current tool runtime resolve placeholders in their credentials only. Headers, OpenAPI schema and call arguments are left untouched. Re-create or migrate the tool to get full resolution.

Quick reference

PlaceholderValue

{{member.id}}

Identifier of the member who triggered the tool

{{member.fullName}}

Their display name in this organization

{{member.email}}

Their account email

{{member.firstName}}

Their first name

{{member.lastName}}

Their last name

{{member.avatarUrl}}

URL of their avatar

{{member.vars.<group>.<key>}}

A value from one of their personal credential groups

{{member.toolInstance.<key>}}

A per-user credential of the tool being called

{{organization.id}}

Identifier of the current organization

{{organization.name}}

Organization display name

{{organization.externalId}}

Your own external identifier for the organization

{{organization.path}}

Organization URL path

{{organization.description}}

Organization description

{{organization.toolInstance.<key>}}

A shared credential of the tool being called

{{instance.<placeholder-id>.<key>}}

A platform-managed secret (app admins only)

{{attachment.<selector>.<field>}}

Metadata or a temporary link for a chat attachment

{{agent.knowledge.attachment.<selector>.<field>}}

Same, for a file in the Mate's knowledge

Placeholders are case-sensitive. {{member.fullName}} is valid; {{member.fullname}} is not and will fail the tool call.

Member placeholders

These describe the human who triggered the tool call — not the Mate, and not the owner of the tool. If three people in a workspace use the same Mate, each call carries their own identity.

PlaceholderWhere the value comes from

{{member.id}}

The member identifier in the current organization

{{member.fullName}}

The display name on their organization membership

{{member.email}}

Their user account, falling back to the membership record

{{member.firstName}}

Same

{{member.lastName}}

Same

{{member.avatarUrl}}

The avatar on their organization membership

Typical uses: passing the requester's email to a ticketing tool so tickets are created under their name, filtering a CRM query by owner, or writing an audit trail on your side.

If a member has not filled in a field (no avatar, no last name), the placeholder resolves to an empty value rather than failing.

Personal variables: member.vars

Every member can store their own credentials from Profile → Connectors. A connector is a named group of key/value pairs — for example a connector holding an apiKey and a baseUrl for your personal CRM account. You then read them with {{member.vars.<group>.<key>}}.

The group name in the placeholder is the connector's identifier, not its display name. When you create a connector, allmates.ai derives that identifier from the name you typed: accents are removed, every non-alphanumeric character becomes a dash, and everything is lowercased.

Connector nameIdentifier to use in the placeholder

CRM

{{member.vars.crm.apiKey}}

Mon CRM perso

{{member.vars.mon-crm-perso.apiKey}}

GitHub (perso)

{{member.vars.github-perso.token}}

Zendesk — Support EU

{{member.vars.zendesk-support-eu.apiKey}}

Renaming a connector later does not change its identifier, so placeholders that already point at it keep working.

  • Values are encrypted at rest and are never displayed back in chat or in logs.

  • The key is the name of the value inside the connector — free-form on purpose, so it can match whatever your tool expects (apiKey, baseUrl, token…).

  • If the connector or the key does not exist, the tool call stops with a clear error instead of sending an empty credential.

This is the right choice when each person must use their own account on a third-party service, and the tool does not declare that credential itself.

Personal connectors exist at member level only. There is no organization equivalent of vars — shared values are declared by the tool and filled in as organization credentials, described below.

Tool credentials: member.toolInstance and organization.toolInstance

Most tools declare the credentials they need — an API key, a base URL, a client secret. Those declared fields are filled from the tool's own settings page and referenced with the toolInstance sub-namespace:

{{member.toolInstance.apiKey}}          # each member fills in their own
{{organization.toolInstance.apiKey}}    # one value shared by the whole organization

The scope is decided by the tool, not by the person writing the placeholder:

  • member — the value is siloed per user. Everyone must fill it in the first time they use the tool; the Mate will ask them in the conversation.

  • organization — the value is shared. An organization admin configures it once from the tool's settings page.

Writing {{organization.toolInstance.apiKey}} for a field the tool declares as member is rejected as a configuration error. The tool's declaration is the source of truth for where the value lives, so the mismatch is never silently corrected.

Fields marked as optional resolve to an empty value when nothing is stored and no default is set. Required fields that are missing stop the call and prompt the person to fill them in — all missing fields at once, not one at a time.

Unlike personal connectors, you never name the tool here: toolInstance always refers to the tool currently being called, so the same instructions work for every tool that declares an apiKey. Only keys the tool declares can be read this way — an undeclared key is reported as a configuration error rather than resolving to nothing.

Platform secrets: instance

Reserved for allmates.ai app administrators, managed from Admin → Instance placeholders. The syntax is {{instance.<placeholder-id>.<key>}}:

{{instance.vendor.apiKey}}

These are platform-level secrets shared across organizations — typically the credentials of a service allmates.ai operates on your behalf. They are not user-fillable, and a placeholder that is disabled or undefined fails the call rather than resolving to nothing.

Attachment placeholders

Use these to hand a file to an external service — for instance, sending the document a user just dropped in the chat to a signature or OCR API.

{{attachment.latest.signedUrl}}
{{attachment.<attachment-id>.filename}}
{{agent.knowledge.attachment.*.signedUrl}}

Selector — latest and * both mean the most recent attachment in this context. You can also pass a specific attachment identifier.

Available fields

FieldValue

id

Attachment identifier

filename (or name)

Original file name

mimeType (or type)

Content type

storagePath

Internal storage path

signedUrl

Temporary download link, usable by an external service

The attachment scope looks at the files of the current conversation. The agent.knowledge.attachment scope looks only at the files attached to the Mate's knowledge.

Signed URLs are short-lived by design — they are generated for the call and are not meant to be stored on the other side.

Mate instruction variables

A second, separate family of variables can be used inside a Mate's instructions. They are written in upper case with a DFIO_ prefix and are replaced when the Mate's system prompt is assembled for a chat.

VariableValue

{{DFIO_AGENT_NAME}}

The Mate's name

{{DFIO_AGENT_PSEUDO}}

The Mate's handle (used for mentions)

{{DFIO_ORGANIZATION_NAME}}

Organization name

{{DFIO_ORGANIZATION_DESCRIPTION}}

Organization description

{{DFIO_WORKSPACE_NAME}}

Workspace name

{{DFIO_WORKSPACE_DESCRIPTION}}

Workspace description

{{DFIO_PROJECT_NAME}}

Conversation name

{{DFIO_PROJECT_LOCALE}}

Conversation language

{{DFIO_PROJECT_OBJECTIVE}}

Conversation objective

{{DFIO_MEMBERS_LIST_HUMANS}}

List of the humans in the conversation

{{DFIO_MEMBERS_LIST_AGENTS}}

List of the Mates in the conversation

Two behaviours worth knowing:

  • Organization and workspace variables resolve to an empty value when the Mate's context inheritance is turned off for that level.

  • There is no date or time variable. {{DFIO_DATETIME}} was removed on purpose: injecting a fresh timestamp on every message invalidates the model's prompt cache and makes every answer more expensive and slower. Ask for the date through a tool if a Mate genuinely needs it.

Reserved variables. These are used by the platform to assemble the global prompt and have no effect in your own instructions: {{DFIO_AGENT_SYSTEM_PROMPT}}, {{DFIO_OPENAPI_TEMPLATE}}, and the whole {{DFIO_CAPABILITIES_*}} family (context blocks for organization, workspace, project, members and mention rules; widget blocks for instructions, HTML, SVG, charts, carousel and documents).

Rules and troubleshooting

Case matters. {{member.fullName}}, not {{member.fullname}}. A typo on a known scope is treated as a configuration error, never as an empty value — better a loud failure than a request sent to your API with a blank identity.

Types are preserved. When a placeholder is the whole value, the original type survives: a number stays a number, a list stays a list. When it sits inside a longer string, it is converted to text, and an empty value becomes an empty string.

Unknown scopes are left alone. A token the platform does not recognise — a parameter your own tool substitutes later, for example — is passed through untouched rather than raising an error.

When something goes wrong, the Mate reports the reason in the conversation:

ReasonWhat it meansWhat to do

missing-value

A required credential has never been filled in

Fill it in from the prompt in chat, or from the tool's settings page

unknown-placeholder

The placeholder does not exist, or is misspelled

Ask an admin to fix the tool configuration

scope-mismatch

The placeholder uses member where the tool declares organization (or the reverse)

Ask an admin to align the placeholder with the tool's declaration

decryption-failed

The stored credential cannot be read

Re-enter the credential

Not available yet. There are no workspace, mate or tool scopes. Workspace information is available in Mate instructions through {{DFIO_WORKSPACE_NAME}} and {{DFIO_WORKSPACE_DESCRIPTION}}, but not in tool configurations.

Security. Personal variables, tool credentials and platform secrets are encrypted at rest, decrypted only for the duration of the call, and never written to logs — neither the encrypted blob nor the resolved value.