Applications & credentials
How your automation platform signs in, and how to keep the secret safe.
What an application is
What your automation platform signs in as: a Client ID, a Client Secret, its redirect URLs and the permissions it may ask for. Most people make one per platform.
Creating one
- 1
- 2
Give it a name the approver will know. The name shows on the approval screen.
- 3
Choose the automation platform. This sets the request format that platform uses.
- 4
Add the redirect URL it expects. The platform guides list the right value for each one.
- 5
Choose the permissions it needs. Fewer is better. You can add more later, but it must be approved again.
The client secret
Shown once, and only once
Treat it like a password: keep it in your platform or a secret manager.
Never put it in a browser, a public repository or a workflow's visible fields.
Rotating a secret
You get a new secret at once. The old one keeps working for a grace period you choose, so live workflows do not break while you update them.
| Grace period | When to use it |
|---|---|
| Immediately | The secret has leaked. Anything still using it stops working now. |
| 1 hour | A single workflow you can update straight away. |
| 24 hours | The usual choice. Time to update and check. |
| 7 days | A slow rollout across several platforms or teams. |
Rotation does not sign anyone out. Existing tokens keep working.
Redirect URLs
Where we may send the authorization code. It must match exactly: no wildcards, no prefixes.
https://only, excepthttp://localhostfor development.No
#fragment.Add every environment you use. A URL not on the list is refused.
Disabling and deleting
Disable
No new tokens. Existing ones run out on their own. You can turn it back on.
Delete
Every credential and authorization is revoked. Workflows stop immediately. You cannot undo this.
Something missing on this page? Tell us and we will fix it.