Integration credentials now live in General Input Vault

The credentials behind your integrations, whether you connected with one-click sign-in, your workspace's own OAuth app, or an API key, now live in General Input Vault instead of our application database. The Vault is a separate service whose only job is holding credentials: it encrypts each one, refreshes OAuth tokens when they expire, and records every time a workflow, agent, or app uses one. Once a connection has moved, the rest of General Input keeps only a reference to it and the names of its fields, and reads the secret from the Vault each time it is needed. Your connections, sharing, and workflows stay as they are, and nobody needs to reconnect. It is the same Vault a self-hosted General Input server uses, so credentials are handled one way everywhere. Browse the integrations you can connect.

How it works

• Moved, not reconnected. Existing connections move over one at a time and keep their identity, so the workflows and triggers wired to them keep working.
• Your OAuth apps move too. A workspace's or member's own OAuth app keeps its client secret in the Vault beside the connections it authorized, and rotating that secret works as before.
• Every use is recorded. Each time a connection is stored, refreshed, or used, the Vault logs it against the member who owns it.
• Built for interruptions. If the Vault is briefly unreachable, runs wait and retry, and a short interruption never pauses a trigger or counts against a workflow.

Also shipped

• An integration's settings panel now says where its secret is stored.
• Tokens handed to your code say when they expire, so a long run knows when to fetch a fresh one.