Create and manage credentials
You can create, view, edit, enable, disable, and delete credentials from automation orchestrator.
Credentials are stored in projects. When you create a credential, you assign it to a project, and it is available to workflows in that project. You can attach a single credential to multiple workflow nodes, and you can update or disable a credential without editing the workflows that reference it.
Create a credential
Create a credential to store authentication values that automation orchestrator uses when running workflows.
Before you begin
- You have the authentication values for the credential you want to create (for example, an API token, username and password, or SSH private key). See Choose a credential type for the required fields for each type.
Procedure
Results
You can also create a credential directly from the workflow builder without navigating to . The Builder credential selector includes a Create new credential option at the top of the dropdown. Automation orchestrator assigns these credentials to the project that owns the workflow. To assign the credential to a different project, use instead. See Attach a credential to a workflow node.
View credentials
Review the credentials list to check configuration, usage, and status for credentials in a project.
Procedure
Results
View credential details
Click a credential name in the list to open the detail view. The detail view shows:
- Details tab: Credential metadata and field values. Secret fields display as
Encryptedrather than showing the stored value. Non-secret fields display in plaintext. - Workflows tab: A list of workflows that reference this credential, showing the workflow name, creator, steps using the credential, the date of the last execution, and status.
- Integrations tab: A list of integrations that use this credential, showing the integration name, type, creator, status, and scope.
Edit a credential
You can update credential fields and values, but you cannot change the credential type after creation.
Procedure
Enable or disable a credential
You can enable or disable a credential using the toggle in the credentials list or the detail view. Disabled credentials cannot be used in workflow execution but remain in the system and can be re-enabled at any time.
Procedure
Results
Disabled credentials appear in the credential selector in the workflow builder, but are marked as disabled and cannot be selected for new assignments.
Delete a credential
Delete a credential to permanently remove it and its encrypted secret material from automation orchestrator. You cannot undo this action.
Before you begin
- You have
credential:deletepermission in the project that contains the credential. - You have reviewed which workflows and integrations reference the credential.
About this task
If workflows or integrations reference the credential, automation orchestrator displays them in the confirmation dialog. You cannot delete a credential that is an integration's management credential; the delete button is disabled until you detach the credential from every integration. A credential that is referenced only by workflows can be deleted, but those workflows then fail at runtime.
Procedure
- Navigate to the credential detail view, or click Delete from the options menu in the credentials list.
- In the confirmation dialog, review the list of affected workflows and integrations.
- Select the confirmation checkbox.
- Click Delete to confirm.
Results
- The credential is no longer displayed in the credentials list.
- The credential name is immediately available for reuse.
Credential masking
Automation orchestrator masks sensitive credential values wherever they could be exposed, so that secrets such as passwords, tokens, and private keys are not visible after you store them.
Masking prevents secrets from leaking through API responses, log output, or exported workflow definitions. Even users with administrative access cannot retrieve a stored secret value. They can only replace it with a new one.
Automation orchestrator applies masking in the following contexts:
- API responses: automation orchestrator replaces sensitive field values with the
$encrypted$placeholder value. Non-sensitive fields return in plaintext. - List views: All field values in list endpoints are masked (both sensitive and non-sensitive) because no decryption occurs for list operations.
- Detail views: Sensitive fields display as
Encrypted. Non-sensitive fields display in plaintext. - Execution logs: automation orchestrator does not include credential values in workflow execution output or logs.
- Workflow definitions: Credentials are referenced by ID only. No credential values are stored in workflow definitions.