Skip to main content

Credentials

🚧 Coming Soon — This API is under active design. Endpoints return 501 Not Implemented until released.

The Credentials API provides a secure vault for storing secrets used by integration connectors. Credentials are encrypted at rest (AES-256-GCM) and the secret value is never returned after creation — only metadata and a masked preview are accessible.

Supported Credential Types​

TypeUsed for
SSH_KEYSFTP servers (private key + optional passphrase)
PASSWORDFTP/FTPS, database, and basic auth endpoints
API_TOKENREST API bearer tokens
AWS_ACCESS_KEYAWS S3 and other AWS services
AZURE_SASAzure Blob Storage shared-access signatures
GCP_SERVICE_ACCOUNTGoogle Cloud Storage and GCP APIs
OAUTH2_CLIENTOAuth2 client credentials flow

Security Model​

  • Secrets are encrypted before being written to the database
  • The plain-text value is never logged or returned after the POST /api/v1/credentials call
  • GET requests return only metadata + a masked hint (e.g. ****KEY)
  • Rotating a credential via PUT /api/v1/credentials/{id} preserves the ID so existing integrations continue to work

Planned Workflow​

  1. Store a credential: POST /api/v1/credentials with the secret
  2. Note the returned id — this is the only reference you need
  3. Reference in integrations: POST /api/v1/integrations using credentialId
  4. Rotate as needed: PUT /api/v1/credentials/{id} with the new secret value

Operations​

📄️ Store a credential

🚧 *Coming Soon* — Store a new credential securely.

📄️ Delete a credential

🚧 *Coming Soon* — Delete a credential. Integrations referencing it will fail until updated.

📄️ Rotate a credential

🚧 *Coming Soon* — Replace the stored credential value (rotation). Metadata is updated, references remain valid.

Schema References​