Companion is a docker image you can install to your Windows/Mac/Linux that will give you tools like "Flow Diff", "Credentials Where-used", "Flow Image".
Reading Credentials
You need to import SecureStoreService at the start of the script.
Then you can call getUserCredential with the credential name, which can be different from the username. Also beware that you need to convert returned password to string.
Externalize
You probably want to externalize credential name to be able to change it without editing the flow.
- Add a Content Modifier step before
- Add a property & externalize it using
{{credential_name}}
- Get credential name in Groovy script using property name
Exception Handling
You can check if secureStoreService or userCredential is null. But if you don't have any solution in the script, you may want to leave exception handling to flow itself.
Groovy IDE notice
You can't use SecureStoreService with GroovyIDE at the moment.
Script
Try it on 
import com.sap.gateway.ip.core.customdev.util.Message;
import java.util.HashMap;
import com.sap.it.api.securestore.SecureStoreService;
import com.sap.it.api.securestore.UserCredential;
import com.sap.it.api.securestore.exception.SecureStoreException;
import com.sap.it.api.ITApiFactory;
def Message processData(Message message) {
// Read from properties to make it more dynamic
def mapProperties = message.getProperties();
def credentialName = mapProperties.get("credential_name_property_key");
// Credential specific code
SecureStoreService secureStoreService = ITApiFactory.getService(SecureStoreService.class, null);
UserCredential userCredential = secureStoreService.getUserCredential(credentialName);
def user = userCredential.getUsername().toString()
def pass = userCredential.getPassword().toString()
message.setProperty("user", user);
message.setProperty("pass", pass);
return message;
}