Credential types
When you create a credential in Credentials manager, you first select a credential type. The credential type determines which fields you fill in. The following sections list the available credential types and the fields that each type uses.
NOTE
Credentials manager is in Early Access. To get access or learn more, contact your account manager or Support.
Common fields [#common-fields]
Every credential type includes the following fields, in addition to the fields that are specific to the type:
| Field | Description |
|---|---|
| Credential name (required) | The name of the credential. Give each credential a clear, descriptive name, especially when you have several credentials of the same type. |
| Expiry date (optional) | The date when the credential expires, in DD/MM/YYYY format. For more information, see Credential expiration. |
Each credential type also has an auth type, for example Basic, Header, Headers, OAuth2, or Custom. The form shows the auth type when you create a credential, and the credentials list shows it in the Auth type column.
Field attributes [#field-attributes]
Each field in a credential type has one or more of the following attributes:
| Attribute | Description |
|---|---|
| Required | You must enter a value in the field to save the credential. Fields that are not marked as required are optional. |
| Sensitive | Credentials manager encrypts the value after you save the credential. The user who created the credential can replace the value later, but nobody can view the value after you save it, including Support. |
Verification URL [#verification-url]
Some credential types include an optional Verification URL field. The URL is a protected resource endpoint that Credentials manager calls to test the connection. Verification marks the credential as Connected or Error.
Generic authentication types [#generic-authentication-types]
Use a generic authentication type to connect to a system that does not have a dedicated credential type. Generic types cover the most common authentication methods.
The following table lists the generic authentication types.
| Type | Use it for | Fields |
|---|---|---|
| Basic | Standard username and password authentication. | Username (required). Password (required, sensitive). |
| Header | Sending a secret as an HTTP header. This covers most API key and token setups. | Header name (required). The field is prefilled with Authorization.Some providers use a different header, for example X-Api-Key.Header value prefix (optional). Examples: Bearer, Token.Header value (required, sensitive). The secret token or API key. |
| OAuth2 client credentials | Machine-to-machine OAuth2 authentication with no user login. | Client ID (required). Client secret (required, sensitive). Token URL (required). Scopes (optional). Enter a space-separated list. Verification URL (optional). Token endpoint authentication (optional). The client authentication method that your OAuth2 provider requires. The default is client_secret_post, which sends the client credentials in the request body. |
| OAuth2 authorization code | Standard OAuth2 login flow that uses a confidential application secret. | Client ID (required). Client secret (required, sensitive). Authorization endpoint (required). Enter the endpoint without query parameters. Token URL (required). Scopes (optional). Enter a space-separated list. Verification URL (optional). |
| OAuth2 authorization code with PKCE | OAuth2 login flow for applications that cannot safely hold a secret. This type is more secure and does not need a client secret. | Client ID (required). Authorization endpoint (required). Enter the endpoint without query parameters. Token URL (required). Scopes (optional). Enter a space-separated list. Verification URL (optional). |
| OAuth2 refresh token | OAuth2 authentication when you already have a long-lived refresh token from a provider. | Client ID (required). Client secret (required, sensitive). Token URL (required). Scopes (optional). Enter a space-separated list. Refresh token (required, sensitive). Verification URL (optional). |
| OAuth2 password grant | OAuth2 authentication with the username and password of the resource owner. | Client ID (required). Client secret (required, sensitive). Username (required). Password (required, sensitive). Token URL (required). Scopes (optional). Enter a space-separated list. Verification URL (optional). |
| OAuth2 JWT bearer | Service-account OAuth2 authentication signed with a private key, for example domain-wide delegation. | Client ID (required). The JWT iss claim.Subject (optional). The identity to impersonate, the JWT sub claim.Leave the field empty to request a token for the service account itself. Audience (required). The JWT aud claim, typically the token endpoint URL of the provider.Private key (required, sensitive). The PKCS8 PEM-encoded RSA private key that signs the JWT assertion. Token URL (required). Scopes (optional). Enter a space-separated list. Verification URL (optional). |
Authorization step for OAuth2 authorization code types [#authorization-step]
Credential types that use the OAuth2 authorization code flow include an authorization step after you save the fields. Select Authorize to open a window, where you log in to the provider and approve access. Credentials manager then stores the resulting access token securely and refreshes it automatically, so you do not need to manage tokens manually.
The following credential types include the authorization step:
- OAuth2 authorization code
- OAuth2 authorization code with PKCE
- HubSpot OAuth2 authorization code
- Microsoft Dynamics CRM OAuth2 authorization code
- Salesforce OAuth2 authorization code
- Zoho CRM OAuth2 authorization code
Version control types [#version-control-types]
Use a version control type to give access to a Git repository.
The following table lists the version control types.
| Type | Use it for | Fields |
|---|---|---|
| Git basic | Access to a Git repository with a username and a password or personal access token. | Repository URL (required). The HTTPS clone URL, for example https://github.com/org/repo.git.Author email (required). The email address used as the commit author identity. Username (required). Your Git username or email address. Password (required, sensitive). Enter an account password or a personal access token with repo scope. |
| Git SSH | SSH key-based access to a Git repository. | Repository URL (required). The SSH clone URL, for example [email protected]:org/repo.git.Author email (required). The email address used as the commit author identity. Private key (required, sensitive). A PEM-encoded RSA, ECDSA, or Ed25519 SSH private key. Passphrase (optional, sensitive). Enter a passphrase only if the key is protected. |
Third-party integration types [#third-party-integration-types]
Third-party integration types are tailored to specific platforms. The form asks only for the fields that the platform needs.
Knowledge bases [#knowledge-bases]
The following table lists the knowledge base credential types.
| Type | Use it for | Fields |
|---|---|---|
| Confluence basic (Server and Cloud) | Basic authentication for Confluence, both Server/Data Center and Cloud. | Base URL (required). Examples: https://your-domain.atlassian.net/wiki, https://confluence.your-domain.com.Username or email (required). Enter the username for Server/Data Center or the email address for Cloud. Password or API token (required, sensitive). Enter the password for Server/Data Center or the API token for Cloud. |
| Confluence PAT (Server) | Personal access token authentication for Confluence Server/Data Center. | Base URL (required). Example: https://confluence.your-domain.com.Personal access token (required, sensitive). Generate the token in your Confluence profile settings. |
| SharePoint OAuth2 | Application-based connection to a SharePoint tenant. | Client ID (required). Client secret (required, sensitive). Tenant ID (required). The Azure Active Directory tenant ID. Tenant name (required). The subdomain of sharepoint.com, for example your-tenant.Resource ID (required). The resource principal ID of the SharePoint app. Schema (required). Values: http, https.Host (required). The SharePoint site hostname, for example your-tenant.sharepoint.com.Port (required). Example: 443. |
Collaboration and productivity [#collaboration-and-productivity]
The following table lists the collaboration and productivity credential types.
| Type | Use it for | Fields |
|---|---|---|
| Jira Cloud basic | Email and API token authentication for Jira Cloud. | Base URL (required). Example: https://your-domain.atlassian.net.Atlassian account email (required). API token (required, sensitive). The API token generated for the Atlassian account. |
| Jira Server basic | Username and password authentication for Jira Server. | Base URL (required). Example: https://jira.example.com.Username (required). Password (required, sensitive). |
CRM and marketing [#crm-and-marketing]
The following table lists the CRM and marketing credential types.
| Type | Use it for | Fields |
|---|---|---|
| HubSpot OAuth2 authorization code | Login-based connection to a HubSpot account. | Client ID (required). The client ID of your HubSpot app. Client secret (required, sensitive). After you save the fields, select Authorize to complete the authorization step. |
| Marketo | OAuth2 client credentials authentication for Marketo. | Client ID (required). The Marketo REST API client ID. Client secret (required, sensitive). Endpoint URL (required). The Marketo REST endpoint URL, for example https://example.mktorest.com/rest.Identity URL (required). The Marketo identity endpoint URL, for example https://example.mktorest.com/identity. |
| Microsoft Dynamics CRM OAuth2 authorization code | Login-based connection to a Dynamics 365 environment. | Client ID (required). The client ID of your Azure AD app registration. Client secret (required, sensitive). Environment URL (required). Example: https://contoso.crm4.dynamics.com.After you save the fields, select Authorize to complete the authorization step. |
| Salesforce OAuth2 authorization code | Secure login-based connection to Salesforce. This type uses PKCE. | Client ID (required). The consumer key of your Salesforce connected app. After you save the field, select Authorize to complete the authorization step. Credentials manager handles the refresh token and access token automatically. |
| SugarCRM | OAuth2 password grant authentication for SugarCRM. | Your SugarCRM domain (required). The URL of the SugarCRM instance. Your OAuth 2.0 consumer key (required). The consumer key of the OAuth application that you created in SugarCRM. Your OAuth 2.0 consumer secret (required, sensitive). Your login (required). The username that you use to log in to SugarCRM. Your password (required, sensitive). Custom platform value (required). Your registered SugarCRM API platform value. Use a unique value to avoid login conflicts. |
| Zoho CRM OAuth2 authorization code | Login-based connection to a Zoho CRM account. | Client ID (required). The client ID of your Zoho connected app. Client secret (required, sensitive). After you save the fields, select Authorize to complete the authorization step. |
Ecommerce and payments [#ecommerce-and-payments]
The following table lists the ecommerce and payment credential types.
| Type | Use it for | Fields |
|---|---|---|
| Adobe Commerce basic | Administrator username and password access to an Adobe Commerce (Magento 2) instance. | Magento edition (required). Select the edition of the Magento instance. Instance URL (required). The base URL of the instance. Username (required). The Magento administrator username. Password (required, sensitive). The Magento administrator password. |
| Adobe Commerce integration token | Integration token access to an Adobe Commerce (Magento 2) instance. | Magento edition (required). Select the edition of the Magento instance. Instance URL (required). The base URL of the instance. Integration token (required, sensitive). The Magento integration access token. |
| BigCommerce | Access token authentication for a BigCommerce store. | Store hash (required). Access token (required, sensitive). The BigCommerce API access token. |
| Shopify client credentials | OAuth2 application-based access to a Shopify store. | Store name (required). Your store subdomain without .myshopify.com, for example my-store.Client ID (required). Client secret (required, sensitive). |
| Shopify token | Direct Admin API token access to a Shopify store. | API token (required, sensitive). Format: shpat_....Store name (required). Your store subdomain without .myshopify.com, for example my-store. |
| Stripe | Secret key authentication for Stripe. | API key (required, sensitive). Your Stripe secret key. |
| VTEX | Application key and application token authentication for VTEX. | App key (required, sensitive). App token (required, sensitive). URL (required). The base URL of your VTEX installation, for example https://your-store.myvtex.com. |
Credential type not listed [#credential-type-not-listed]
If no dedicated credential type exists for your system, use one of the generic authentication types. If none of the credential types fits your use case, contact Support.
Was this page helpful?