Credentials manager

Credentials manager gives you a single, secure place to store and manage sensitive information. Your integrations depend on this information, for example API keys, tokens, passwords, and other secrets. Together, these are called credentials.

To open Credentials manager, select Credentials manager in the main menu of the web interface. Use it if you connect your account to external systems, APIs, or integrations.

Why use Credentials manager [#why-use-credentials-manager]

Credentials manager offers the following benefits:

• Security by design: Credentials manager stores your sensitive values securely in one central place, not scattered across configuration files, spreadsheets, or individual product settings.
• Easier lifecycle management: Set an expiry date and receive email reminders before a credential expires. Update the credential when a value changes, for example when you rotate a key.
• Consistency: Every credential follows the structure defined by its credential type.

Key concepts [#key-concepts]

Credential: A named set of key-value data that you create and manage, for example an API key and its associated metadata.

Credential type: A template that defines the structure of a credential. The credential type determines which fields the credential has and what type of data each field holds. For the list of available credential types and their fields, see Credential types.

Credentials and API keys: Credentials manager stores credentials for other systems. It does not store the API keys that you use to make API requests. For information about API keys, see API authentication.

What you can do with Credentials manager [#what-you-can-do]

You can manage credentials in the following ways:

• Create credentials: Choose a credential type and enter the values for the fields that the type defines. You must fill in all required fields to save a credential. Give each credential a clear, descriptive name, especially when you have several credentials of the same type.
• Edit credentials: Update a credential when a value changes, for example when you rotate a key or change a password.
• Verify credentials: Test whether a credential can connect successfully, before or after you save it. For more information, see Credential status and verification.
• Delete credentials: Remove credentials that you no longer use. For more information, see Credential deletion.
• Request a credential type: If none of the available credential types fits your integration, use a generic authentication type, or contact Support to request one. For more information, see Credential type not listed.

How sensitive values are protected [#how-sensitive-values-are-protected]

Some fields in a credential type are sensitive fields. After you save a credential, Credentials manager encrypts the value of each sensitive field. After you save the credential, nobody can view the value, including you, other users, and Support.

If you created the credential, you can replace the value of a sensitive field later.

For credential types that use the OAuth2 authorization code flow, you also select Authorize after you save the fields. A window opens, where you log in to the provider and approve access. Credentials manager then securely stores the resulting access token and refreshes it automatically, so you do not need to manage tokens manually. For more information, see Authorization step for OAuth2 authorization code types.

Credential status and verification [#credential-status-and-verification]

Verification tests whether a credential can connect successfully. A credential type can include an optional Verification URL field that Credentials manager uses to test the connection. You can verify only credentials whose credential type has a verification URL. For other credential types, Verify connection does not appear. For credential types that use the OAuth2 authorization code flow, verification is automatic, because the authorization flow itself proves that the credential works.

You can verify a credential at the following points:

• Before you save it: If verification succeeds, Credentials manager saves the credential with the Connected status. If verification fails, Credentials manager asks you to confirm whether to save the credential anyway. If you save it, the credential has the Error status.
• From the credentials list: Select Verify connection next to a saved credential. Credentials manager saves the result as the credential status.
• On a schedule: Credentials manager verifies saved credentials once a day to keep their status up to date.

The following table describes the credential statuses.

Who can edit a credential [#who-can-edit-a-credential]

If you created a credential, you can edit and delete it.

Credentials that other users created are read-only for you. You can run verification on these credentials, but you cannot edit or delete them.

Credential expiration [#credential-expiration]

When you create a credential, you can set an optional Expiry date. The Expires column in the credentials list shows the expiry date of each credential. When a credential is about to expire, its date is shown in orange. After a credential expires, its date is shown in red. Hover over the date to see how many days ago the credential expired.

You receive an email 7 days, 3 days, and 1 day before a credential expires. The email contains the name of the credential.

Credential deletion [#deleting-credentials]

To delete a credential, select Delete next to it in the credentials list or in its edit view.

When you delete a credential, you can choose between two delete options.

Related pages [#related-pages]

• Security recommendations
• API authentication