Skip to main content
Use Connections → Authentication to manage reusable encrypted credentials. A shared credential can be referenced by API Connections, MCP Servers, and protected web sources instead of copying the same secret into several integrations.

​
Supported authentication types

The current credential manager supports:
  • API key;
  • Bearer token;
  • Basic authentication;
  • OAuth 2.0 client credentials; and
  • custom authentication headers.

​
Create a credential

Give the credential a clear name that describes the external account or environment, such as Orders API production rather than API key 2. Enter the appropriate secret material and save it. Secrets are encrypted and are not displayed back to users after storage.

​
Reuse a credential

After creation, the credential appears in connection authentication selectors. When an API/MCP/web source references the credential, the Connections UI can show how many integrations use it and which resources reference it. This is useful during rotation because you can see the blast radius before touching the secret.

​
Edit without replacing the secret

When editing an existing credential, leaving secret/header fields blank preserves the existing encrypted values. Only enter new secret material when you actually intend to rotate or replace it.

​
Deactivate a credential

Deactivation prevents referencing integrations from authenticating until the credential is re-enabled. If a credential is still referenced, the UI warns before deactivation. Use this when you need a reversible emergency stop without immediately deleting the record.

​
Delete a credential

A credential cannot be safely deleted while integrations still reference it. Reassign or remove every referencing integration first, then delete the unused credential.

​
Rotation workflow

A safe rotation usually looks like:
  1. issue the new secret in the external system;
  2. update the shared RAUM credential;
  3. test every important referencing integration;
  4. run Simulation for action workflows if appropriate; and
  5. revoke the old secret in the external system.
This order avoids turning credential rotation into an outage-management exercise.

​
Custom headers

Custom authentication headers are entered as a JSON object whose values are strings. Keep only authentication material in these headers. Ordinary request headers that are part of the API contract belong in the API Connection itself.

API Connections

Attach shared credentials to direct HTTP integrations.

MCP Servers

Reuse encrypted authentication for hosted tool servers.