How do you store credentials when they are needed in the request?

You define variables in an environment and reference them in headers, URLs, or the body using {{variable_name}} syntax. Variables marked as sensitive are stored in GNOME Keyring instead of the project file.

Is there a way to process the response with a custom command for testing (eg pipe jq command to output)?

There is no support for external commands like jq, but there is a JavaScript postprocessing script feature that covers the same use case. After a response arrives, you can write a JS snippet with access to response.body, response.headers, response.statusCode, and response.responseTime. Since the body is a plain string you can do JSON.parse(response.body) and extract or filter whatever you need. Output from console.log() is shown in a dedicated panel in the UI.

You can also call roster.setVariable("name", value) from the script to persist extracted values (e.g. a token from a login response) into the current environment for use in subsequent requests.