Integration Service user guide

Instead of entering credentials directly when creating connections, you can reference an Orchestrator credential asset linked to an external vault. Integration Service resolves the credential at runtime through Orchestrator and never stores it in the Integration Service database.

This feature is designed for organizations with centralized credential management requirements or strict security and compliance policies.

When a connection uses a credential asset, Integration Service calls the Orchestrator credential asset, which in turn retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If a credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Set up a credential store in Orchestrator that connects to your external vault.

For instructions, see About credential stores in the Orchestrator user guide.

In an Orchestrator folder, create an asset of type Credential and link it to the secret in the credential store.

For instructions, see Managing assets in Orchestrator in the Orchestrator user guide.

Are credentials fetched from the vault on every request?

No. Credentials are cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured.

What happens when a credential is rotated before the cache expires?

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step.

Are credentials stored in Integration Service?

No. Credentials are not written to the Integration Service database. They are held in memory in an encrypted state for the one-hour cache duration only.

Does this work for all connectors?

Yes. This feature works with all connectors. Any connector that has secret-type input fields on its connection form (such as API Key, Password, or Client Secret) supports credential asset references, regardless of authentication type.

Does this apply to all fields on the connection form?

Currently, only secret-type fields are supported (such as passwords, API keys, and client secrets). Support for additional field types is planned.

Which Orchestrator asset types are supported?

Only assets of type Credential are supported. Text, Boolean, and Integer assets cannot be used.

Which external vaults are supported?

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores.

Is proxy supported?

Yes. Both connected and disconnected proxy configurations are supported.

Can I use a credential asset for OAuth tokens?

No. OAuth 2.0 access and refresh tokens are always stored in Integration Service after the initial authorization flow. Only secret-type input fields on the connection screen (such as Client Secret in BYOA authentication) can reference a credential asset.