Use credential assets for connections

Instead of entering credentials directly when creating connections, you can reference an Orchestrator credential asset linked to an external vault. Integration Service resolves the credential at runtime through Orchestrator and never stores it in the Integration Service database.

This feature is designed for organizations with centralized credential management requirements or strict security and compliance policies.

Cómo funciona

When a connection uses a credential asset, Integration Service calls the Orchestrator credential asset, which in turn retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If a credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Nota:

This feature applies to secret-type fields on the connection screen (such as passwords, API keys, and client secrets). OAuth 2.0 access and refresh tokens are still stored in Integration Service after the initial authorization flow, because the OAuth protocol requires more than a client secret to authenticate. You can use a credential asset for the client secret field in BYOA (Bring your own OAuth 2.0 app) authentication types, but not for the resulting OAuth tokens.

Requisitos previos

• Integration Service está habilitado y aprovisionado para tu tenant.
• At least one credential store is configured in Orchestrator. Supported external vaults include CyberArk, HashiCorp Vault, and all others supported by Orchestrator's credential store integrations.
• A credential asset of type Credential exists in an Orchestrator folder that references the vault secret. Assets of type Text, Integer, or Boolean are not supported.

Step 1: Configure the credential store in Orchestrator

Set up a credential store in Orchestrator that connects to your external vault.

For instructions, see About credential stores in the Orchestrator user guide.

Step 2: Create a credential asset in Orchestrator

In an Orchestrator folder, create an asset of type Credential and link it to the secret in the credential store.

For instructions, see Managing assets in Orchestrator in the Orchestrator user guide.

Step 3: Reference the credential asset when creating a connection

1. In Orchestrator, select a folder and navigate to the Connections tab.

2. Select Add connection and choose the connector.

3. On the connection creation page, locate a secret-type field (for example, Password, API Key, or Client Secret).

4. Select the menu icon next to the field and select Use credential asset.

   

5. Select the credential asset you want to use. You can select assets from any Orchestrator folder you have access to.

6. Complete any remaining fields and select Connect.

Preguntas frecuentes

Are credentials fetched from the vault on every request?

No. Credentials are cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured.

What happens when a credential is rotated before the cache expires?

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step.

Are credentials stored in Integration Service?

No. Credentials are not written to the Integration Service database. They are held in memory in an encrypted state for the one-hour cache duration only.

Does this work for all connectors?

Yes. This feature works with all connectors. Any connector that has secret-type input fields on its connection form (such as API Key, Password, or Client Secret) supports credential asset references, regardless of authentication type.

Does this apply to all fields on the connection form?

Currently, only secret-type fields are supported (such as passwords, API keys, and client secrets). Support for additional field types is planned.

Which Orchestrator asset types are supported?

Only assets of type Credential are supported. Text, Boolean, and Integer assets cannot be used.

Which external vaults are supported?

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores.

Is proxy supported?

Yes. Both connected and disconnected proxy configurations are supported.

Can I use a credential asset for OAuth tokens?

No. OAuth 2.0 access and refresh tokens are always stored in Integration Service after the initial authorization flow. Only secret-type input fields on the connection screen (such as Client Secret in BYOA authentication) can reference a credential asset.