Create and manage credentials

You can create, view, edit, enable, disable, and delete credentials from automation orchestrator.

Credentials are stored in projects. When you create a credential, you assign it to a project, and it is available to workflows in that project. You can attach a single credential to multiple workflow nodes, and you can update or disable a credential without editing the workflows that reference it.

Create a credential

Create a credential to store authentication values that automation orchestrator uses when running workflows.

Before you begin

  • You have the authentication values for the credential you want to create (for example, an API token, username and password, or SSH private key). See Choose a credential type for the required fields for each type.

Procedure

  1. Go to Configuration > Credentials.
  2. Click Create credential.
  3. In the credential creation modal, enter the following information:
    • Name (required): A unique name for the credential.
    • Description (optional): A description to help identify the credential's purpose.
    • Project (required): Select the project that owns this credential. For more information, see Understand projects.
    • Credential type (required): Select a credential type from the dropdown. The available field inputs update based on your selection.
  4. Complete the required fields for the selected credential type.

    Secret fields are masked by default. Click the visibility toggle icon to view entered values.

  5. Click Create credential to save the credential.

Results

Note:

You can also create a credential directly from the workflow builder without navigating to Configuration > Credentials. The Builder credential selector includes a Create new credential option at the top of the dropdown. Automation orchestrator assigns these credentials to the project that owns the workflow. To assign the credential to a different project, use Configuration > Credentials instead. See Attach a credential to a workflow node.

View credentials

Review the credentials list to check configuration, usage, and status for credentials in a project.

Procedure

  1. Go to Configuration > Credentials.
  2. Select a project from the project switcher.

    The credentials list shows credentials that belong to the selected project and displays the following information:

    • Name: The credential name (select to open the detail view)
    • Type: The credential type
    • Workflows: The number of workflows using this credential
    • Integrations: The number of integrations using this credential
    • Created: The creation date
    • Last modified: The date of the last update
    • State: The enabled or disabled status

    Use the filter bar to search for credentials by name. Click column headers to sort the list.

Results

View credential details

Click a credential name in the list to open the detail view. The detail view shows:

  • Details tab: Credential metadata and field values. Secret fields display as Encrypted rather than showing the stored value. Non-secret fields display in plaintext.
  • Workflows tab: A list of workflows that reference this credential, showing the workflow name, creator, steps using the credential, the date of the last execution, and status.
  • Integrations tab: A list of integrations that use this credential, showing the integration name, type, creator, status, and scope.

Edit a credential

You can update credential fields and values, but you cannot change the credential type after creation.

Procedure

  1. Go to the credential detail view, or click the edit icon in the credentials list.
  2. Click Edit credential.
  3. Update the fields you want to change.

    The credential type cannot be changed after creation. For secret fields, the current value is shown as masked placeholder dots. Enter a new value to replace the existing one. If you do not modify a secret field, the existing encrypted value is preserved.

  4. Click Save changes to apply changes.

Enable or disable a credential

You can enable or disable a credential using the toggle in the credentials list or the detail view. Disabled credentials cannot be used in workflow execution but remain in the system and can be re-enabled at any time.

Procedure

  1. Go to Configuration > Credentials.
  2. Find the credential you want to enable or disable.
  3. Enable or disable the credential using one of the following methods:
    • In the credentials list, click the toggle in the State column.
    • Click the credential name to open the detail view, then click the toggle at the top of the page.
  4. If you are disabling a credential, review the confirmation dialog, which lists the workflows that reference this credential, and confirm the action.
    Warning:

    Disabling a credential causes any workflow that references it to fail at the node that uses the credential.

Results

Disabled credentials appear in the credential selector in the workflow builder, but are marked as disabled and cannot be selected for new assignments.

Delete a credential

Delete a credential to permanently remove it and its encrypted secret material from automation orchestrator. You cannot undo this action.

Before you begin

  • You have credential:delete permission in the project that contains the credential.
  • You have reviewed which workflows and integrations reference the credential.

About this task

If workflows or integrations reference the credential, automation orchestrator displays them in the confirmation dialog. You cannot delete a credential that is an integration's management credential; the delete button is disabled until you detach the credential from every integration. A credential that is referenced only by workflows can be deleted, but those workflows then fail at runtime.

Procedure

  1. Navigate to the credential detail view, or click Delete from the options menu in the credentials list.
  2. In the confirmation dialog, review the list of affected workflows and integrations.
  3. Select the confirmation checkbox.
  4. Click Delete to confirm.

Results

  • The credential is no longer displayed in the credentials list.
  • The credential name is immediately available for reuse.

Credential masking

Automation orchestrator masks sensitive credential values wherever they could be exposed, so that secrets such as passwords, tokens, and private keys are not visible after you store them.

Masking prevents secrets from leaking through API responses, log output, or exported workflow definitions. Even users with administrative access cannot retrieve a stored secret value. They can only replace it with a new one.

Automation orchestrator applies masking in the following contexts:

  • API responses: automation orchestrator replaces sensitive field values with the $encrypted$ placeholder value. Non-sensitive fields return in plaintext.
  • List views: All field values in list endpoints are masked (both sensitive and non-sensitive) because no decryption occurs for list operations.
  • Detail views: Sensitive fields display as Encrypted. Non-sensitive fields display in plaintext.
  • Execution logs: automation orchestrator does not include credential values in workflow execution output or logs.
  • Workflow definitions: Credentials are referenced by ID only. No credential values are stored in workflow definitions.