--- a/macros.xml	Fri Jun 13 20:46:09 2025 +0000
+++ b/macros.xml	Mon Jan 26 15:04:30 2026 +0000
@@ -2,13 +2,14 @@
     <!-- for historic reasons the omero-py version is used as the version for all tools -->
     <token name="@TOOL_VERSION@">5.18.0</token>
     <token name="@EZOMERO_VERSION@">3.0.1</token>
-    <token name="@PROFILE@">23.0</token>
+    <token name="@PROFILE@">25.1</token>
 
     <xml name="ezomero_requirements">
         <requirements>
             <requirement type="package" version="@EZOMERO_VERSION@">ezomero</requirement>
             <requirement type="package" version="2.2.2">pandas</requirement>
             <yield/>
+            <expand macro="omero_credentials"/>
         </requirements>
     </xml>
 
@@ -18,9 +19,17 @@
             <!-- openjdk is needed: https://github.com/conda-forge/omero-py-feedstock/pull/16 -->
             <requirement type="package" version="21.0.2">openjdk</requirement>
             <yield/>
+            <expand macro="omero_credentials"/>
         </requirements>
     </xml>
-    
+
+    <xml name="omero_credentials">
+        <credentials name="OMERO" version="0.1" label="OMERO Credentials" description="Input a set of credentials to access a target OMERO.server">
+            <variable name="username" inject_as_env="OMERO_USER" optional="true" label="OMERO username" description="OMERO username" />
+            <secret name="password" inject_as_env="OMERO_PASSWORD" optional="true" label="OMERO password" description="OMERO password" />
+            <secret name="uuid-key" inject_as_env="UUID_SESSION_KEY" optional="true" label="OMERO UUID Session Key" description="Input your session key here to connect using an existing OMERO session key. More information on how to find a session key: https://omero.readthedocs.io/en/stable/users/cli/sessions.html" />
+        </credentials>
+    </xml>
 
     <xml name="host_port">
         <param name="omero_host" type="text" label="OMERO host URL">
@@ -30,27 +39,49 @@
         <param argument="omero_port" type="integer" optional="false" value="4064" label="OMERO port"/>
         <param name="test_username" type="hidden" value=""/>
         <param name="test_password" type="hidden" value=""/>
+        <conditional name="session_id">
+            <param name="session_id_input" type="select" label="Create an OMERO session using a UUID key?" help="Connect to OMERO trough an existing connection (no password/username input)">
+                <option value="no">No</option>
+                <option value="yes">Yes</option>
+            </param>
+            <when value="yes">
+                <param name="close_connection" type="boolean" truevalue="True" falsevalue="False" label="Close the connection after executing the tool?"
+                help="If yes, the current OMERO connection will be closed after tools execution. UUID key cannot be used again in further tools."/>
+            </when>
+            <when value="no">
+            </when>
+        </conditional>
     </xml>
+
     <token name="@HOST_PORT@">
         --host '$omero_host'
         --port $omero_port
     </token>
 
-    <xml name="credentials">
-        <configfile name="credentials"><![CDATA[
-{
-    "username": "$__user__.extra_preferences.get('omero_account|username', $test_username)",
-    "password": "$__user__.extra_preferences.get('omero_account|password', $test_password)"
-}
-        ]]></configfile>
-    </xml>
+    <token name="@SESSION_ID@">
+        #if $session_id.session_id_input== "yes"
+            --session_close $close_connection
+        #else
+            --session_close "True"
+        #end if
+    </token>
+
 
     <token name="@SECURITY_DISCLAIMER@">
-    **OMERO-suite Security Diclaimer:** To utilize the OMERO tools, the user must trust Galaxy instances.
-    The configuration file, which contains your OMERO password and username, is stored in the job working directory.
-    This directory only exists during the runtime of the job and should only be accessible by the system user that runs the job.
-    However, please be aware that your username and password may be exposed to users with administrative rights.
-    We are working on increasing the security of the OMERO suite
+    **OMERO-suite Security Notice**
+
+    To use the OMERO tools, you must trust the Galaxy instance hosting your job.
+    Your OMERO username and password are stored in a temporary configuration file during job execution.
+
+    This file is accessible only to the system account running the job,
+    but may in principle be viewed by Galaxy administrators with elevated rights.
+
+    The file is removed after job completion and is not persistently stored.
+    **We recommend using service-specific or temporary OMERO credentials whenever possible.**
+
+    We are actively working to further improve security,
+    for example by enabling the UUID-key authentication.
+    The European Galaxy Server is operated in compliance with the EU General Data Protection Regulation (GDPR).
     </token>
 
 </macros>
\ No newline at end of file