Overview
CaseBender separates secret material from connector configuration:
- A credential contains the encrypted authentication material and its version history.
- A connection selects a connector, non-secret endpoint configuration, organization scope, and live or test credential.
- A binding controls where a credential may be used.
Raw secrets are accepted only during create or rotate operations. They are not
returned to the browser, logs, exports, workflow definitions, or connector
manifests.
Add a governed connection
Use Settings → Integrations → Connections → Add integration. The guided
flow creates the credential and connection as one operation:
- Choose a certified connector and authentication method.
- Enter non-secret endpoint or tenant values under Connection details.
- Enter API keys, passwords, or application secrets under Authentication.
- Review organization scope, requested OAuth scopes, and advanced host access.
- Connect and run the initial health check.
Use separate credentials for test and production. Host restrictions are enforced
by the connector worker before outbound traffic is sent.
For authorization-code connectors such as Slack, choose the OAuth mode and
select Authorize with vendor. Casebender verifies signed state and PKCE,
exchanges the one-time code at the connector’s allowlisted token endpoint, and
stores the resulting token as a new encrypted credential version. OAuth client
secrets and access tokens are never returned after the flow completes.
Manage a connection
Select Manage on a Connections row to open the full settings workspace:
- General controls the name, description, organization scope, required
endpoint, enabled state, health summary, and connection test.
- Authentication shows the currently selected credential. Select
Replace authentication to use an existing compatible credential or create
a new one inline. Creating authentication here updates this connection; it
does not create another connection.
- Automation controls polling, webhook ingestion, automatic case creation,
synchronization, mappings, and provider actions.
- Advanced contains low-frequency transport and provider options, approved
hosts, connector information, webhook-key rotation, and the Danger zone.
Non-secret settings use one Save action and are synchronized to compatibility
records in the same transaction. If you close Manage with unsaved changes,
CaseBender asks before discarding them. Removing an integration from the
Advanced tab stops polling, ingestion, and workflow actions. Its encrypted
authentication remains in the Credential vault so an administrator can reuse
or revoke it separately.
A failed test does not delete the connection. Correct the endpoint or
authentication and retry from the same dialog.
Rotate credentials and webhook keys
Open Settings → Integrations → Credential vault for the advanced encrypted
credential inventory. Create replacement authentication from the connection’s
Authentication tab. Non-OAuth methods are encrypted and selected immediately.
OAuth returns to the same connection and selects the authorized credential
without creating a duplicate connection.
Credential rotation creates a new immutable version and makes it active without
rewriting workflow definitions. Webhook keys are shown only once when issued.
During a controlled rollover, the current and previous webhook key hashes can be
accepted; retire the previous key after producers have switched.
Access control
Creating, rotating, exporting, or testing integration credentials requires the
integration administration permission and step-up authentication. Workflow
authors can select only connections visible to their current organization.
Never paste API keys into connector configuration, workflow inputs, or custom
HTTP headers. Store them as credentials so redaction, rotation, audit, and host
policy controls apply.
