> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials and Connections

> Store secrets in the governed vault and bind them to reusable integration connections.

## Overview

CaseBender separates secret material from connector configuration:

* A **credential** contains the encrypted authentication material and its version history.
* A **connection** selects a connector, non-secret endpoint configuration, organization scope, and live or test credential.
* A **binding** controls where a credential may be used.

Raw secrets are accepted only during create or rotate operations. They are not
returned to the browser, logs, exports, workflow definitions, or connector
manifests.

## Add a governed connection

Use **Settings → Integrations → Connections → Add integration**. The guided
flow creates the credential and connection as one operation:

1. Choose a certified connector and authentication method.
2. Enter non-secret endpoint or tenant values under **Connection details**.
3. Enter API keys, passwords, or application secrets under **Authentication**.
4. Review organization scope, requested OAuth scopes, and advanced host access.
5. Connect and run the initial health check.

Use separate credentials for test and production. Host restrictions are enforced
by the connector worker before outbound traffic is sent.

For authorization-code connectors such as Slack, choose the OAuth mode and
select **Authorize with vendor**. Casebender verifies signed state and PKCE,
exchanges the one-time code at the connector's allowlisted token endpoint, and
stores the resulting token as a new encrypted credential version. OAuth client
secrets and access tokens are never returned after the flow completes.

## Manage a connection

Select **Manage** on a Connections row to open the full settings workspace:

* **General** controls the name, description, organization scope, required
  endpoint, enabled state, health summary, and connection test.
* **Authentication** shows the currently selected credential. Select
  **Replace authentication** to use an existing compatible credential or create
  a new one inline. Creating authentication here updates this connection; it
  does not create another connection.
* **Automation** controls polling, webhook ingestion, automatic case creation,
  synchronization, mappings, and provider actions.
* **Advanced** contains low-frequency transport and provider options, approved
  hosts, connector information, webhook-key rotation, and the Danger zone.

Non-secret settings use one Save action and are synchronized to compatibility
records in the same transaction. If you close Manage with unsaved changes,
CaseBender asks before discarding them. Removing an integration from the
Advanced tab stops polling, ingestion, and workflow actions. Its encrypted
authentication remains in the Credential vault so an administrator can reuse
or revoke it separately.

A failed test does not delete the connection. Correct the endpoint or
authentication and retry from the same dialog.

## Rotate credentials and webhook keys

Open **Settings → Integrations → Credential vault** for the advanced encrypted
credential inventory. Create replacement authentication from the connection's
Authentication tab. Non-OAuth methods are encrypted and selected immediately.
OAuth returns to the same connection and selects the authorized credential
without creating a duplicate connection.

Credential rotation creates a new immutable version and makes it active without
rewriting workflow definitions. Webhook keys are shown only once when issued.
During a controlled rollover, the current and previous webhook key hashes can be
accepted; retire the previous key after producers have switched.

## Access control

Creating, rotating, exporting, or testing integration credentials requires the
integration administration permission and step-up authentication. Workflow
authors can select only connections visible to their current organization.

<Warning>
  Never paste API keys into connector configuration, workflow inputs, or custom
  HTTP headers. Store them as credentials so redaction, rotation, audit, and host
  policy controls apply.
</Warning>