Credentials and Connections

​

Overview

CaseBender separates secret material from connector configuration:

• A credential contains the encrypted authentication material and its version history.
• A connection selects a connector, non-secret endpoint configuration, organization scope, and live or test credential.
• A binding controls where a credential may be used.

Raw secrets are accepted only during create or rotate operations. They are not returned to the browser, logs, exports, workflow definitions, or connector manifests.

​

Add a governed connection

Use Settings → Integrations → Connections → Add integration. The guided flow creates the credential and connection as one operation:

1. Choose a certified connector and authentication method.
2. Enter non-secret endpoint or tenant values under Connection details.
3. Enter API keys, passwords, or application secrets under Authentication.
4. Review organization scope, requested OAuth scopes, and advanced host access.
5. Connect and run the initial health check.

Use separate credentials for test and production. Host restrictions are enforced by the connector worker before outbound traffic is sent. For authorization-code connectors such as Slack, choose the OAuth mode and select Authorize with vendor. Casebender verifies signed state and PKCE, exchanges the one-time code at the connector’s allowlisted token endpoint, and stores the resulting token as a new encrypted credential version. OAuth client secrets and access tokens are never returned after the flow completes.

​

Manage a connection

Select Manage on a Connections row to open the full settings workspace:

• General controls the name, description, organization scope, required endpoint, enabled state, health summary, and connection test.
• Authentication shows the currently selected credential. Select Replace authentication to use an existing compatible credential or create a new one inline. Creating authentication here updates this connection; it does not create another connection.
• Automation controls polling, webhook ingestion, automatic case creation, synchronization, mappings, and provider actions.
• Advanced contains low-frequency transport and provider options, approved hosts, connector information, webhook-key rotation, and the Danger zone.

Non-secret settings use one Save action and are synchronized to compatibility records in the same transaction. If you close Manage with unsaved changes, CaseBender asks before discarding them. Removing an integration from the Advanced tab stops polling, ingestion, and workflow actions. Its encrypted authentication remains in the Credential vault so an administrator can reuse or revoke it separately. A failed test does not delete the connection. Correct the endpoint or authentication and retry from the same dialog.

​

Rotate credentials and webhook keys

Open Settings → Integrations → Credential vault for the advanced encrypted credential inventory. Create replacement authentication from the connection’s Authentication tab. Non-OAuth methods are encrypted and selected immediately. OAuth returns to the same connection and selects the authorized credential without creating a duplicate connection. Credential rotation creates a new immutable version and makes it active without rewriting workflow definitions. Webhook keys are shown only once when issued. During a controlled rollover, the current and previous webhook key hashes can be accepted; retire the previous key after producers have switched.

​

Access control

Creating, rotating, exporting, or testing integration credentials requires the integration administration permission and step-up authentication. Workflow authors can select only connections visible to their current organization.