Usar activos de credenciales para las conexiones

Instead of entering values directly when creating connections, you can reference Orchestrator assets. For secret fields such as passwords, API keys, and client secrets, Integration Service resolves a Credential asset through Orchestrator from a linked external vault and never stores the value in the Integration Service database. For other fields, the value is read from a standard Orchestrator Text, Bool, or Integer asset.

This feature is designed for organizations with centralized configuration management requirements, or with strict security and compliance policies around credential handling.

Cómo funciona

Credential assets (secret fields)

When a connection uses a Credential asset, Integration Service calls Orchestrator, which retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If the credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Text, Bool, and Integer assets (other fields)

When a connection uses a Text, Bool, or Integer asset, Integration Service reads the value from Orchestrator. No external vault is involved.

Nota:

The asset types shown in the picker depend on the field. Secret fields such as Password, API Key, and Client Secret show only Credential assets. Other supported fields show Text, Bool, and Integer assets. Drop-down fields do not show the picker. OAuth 2.0 access and refresh tokens are still stored in Integration Service after the initial authorization flow, because the OAuth protocol requires more than a client secret to authenticate. You can use a credential asset for the client secret field in BYOA (Bring your own OAuth 2.0 app) authentication types, but not for the resulting OAuth tokens.

Requisitos previos

• Integration Service está habilitado y aprovisionado para tu tenant.
• If using Credential assets for secret fields: at least one credential store is configured in Orchestrator. Supported external vaults include CyberArk, HashiCorp Vault, and all others supported by Orchestrator's credential store integrations.
• One or more Orchestrator assets are available in the folder where the connection is created. The asset type depends on the field — secret fields such as Password, API Key, and Client Secret require a Credential asset; other fields accept a Text, Bool, or Integer asset.

Step 1: Configure the credential store in Orchestrator (Credential assets only)

If you plan to use Credential assets for secret fields, set up a credential store in Orchestrator that connects to your external vault. Skip this step if you only need Text, Bool, or Integer assets.

Para obtener instrucciones, consulta Acerca de los almacenes de credenciales en la guía del usuario de Orchestrator.

Step 2: Create an asset in Orchestrator

In an Orchestrator folder, create the asset that matches the field type you want to supply:

• For secret fields: create an asset of type Credential and link it to the secret in the credential store.
• For other fields: create a Text, Bool, or Integer asset and enter the value directly.

Para obtener instrucciones, consulta Gestionar activos en Orchestrator en la guía del usuario de Orchestrator.

Paso 3: haz referencia al activo de credenciales al crear una conexión

1. En Orchestrator, selecciona una carpeta y ve a la pestaña Conexiones .

2. Selecciona Añadir conexión y elige el conector.

3. On the connection creation page, locate a supported field. Secret fields (Password, API Key, Client Secret) and plain text fields (such as Client ID or Token URL) both support Orchestrator assets.

4. Select the menu icon next to the field and select Use credential asset (for secret fields) or Use Orchestrator asset (for other fields).

   

5. Select the asset you want to use. You can select assets that are either found in the folder where you are creating the connection or shared with the folder using asset links.

6. Completa los campos restantes y selecciona Conectar.

Preguntas frecuentes

Are Credential asset values fetched from the vault on every request?

No. When a Credential asset is used, its value is cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured. Text, Bool, and Integer asset values are read from Orchestrator on each use and are not cached.

What happens when a Credential asset is rotated before the cache expires?

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step. This applies to Credential assets only.

Are asset values stored in Integration Service?

For Credential assets: no. Values are not written to the Integration Service database and are held in memory in an encrypted state for the one-hour cache duration only. For Text, Bool, and Integer assets: values are read from Orchestrator at the time the connection is used and are not persisted in Integration Service.

¿Funciona esto para todos los conectores?

Yes. This feature works with all connectors, regardless of authentication type.

¿Esto se aplica a todos los campos del formulario de conexión?

Dropdown fields are not supported — the picker does not appear on them. On all other fields, the picker shows only the asset types compatible with that field. Secret fields such as Password and API Key show only Credential assets; other fields show Text, Bool, and Integer assets.

¿Qué tipos de activos de Orchestrator son compatibles?

The asset types available depend on the field type:

Campo	Available asset types
Secret fields (Password, API Key, Client Secret)	Credencial
Other fields	Text, Bool, Integer

¿Qué almacenes externos son compatibles?

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores. External vaults apply to Credential assets only — Text, Bool, and Integer assets store their values directly in Orchestrator.

¿Es compatible el proxy?

Sí. Se admiten tanto las configuraciones de proxy conectado como desconectado.

¿Puedo utilizar un activo de credenciales para tokens OAuth?

No. Los tokens de acceso y actualización de OAuth 2.0 siempre se almacenan en Integration Service después del flujo de autorización inicial. Solo los campos de entrada de tipo secreto en la pantalla de conexión (como Secreto de cliente en la autenticación BYOA) pueden hacer referencia a un activo de credenciales.