Managing API credentials and secrets directly within your workflow code creates unnecessary security risks, such as accidentally logging sensitive information or exposing keys in environment variables.
Our credential proxy system provides a "zero trust" approach to authentication. It transparently injects your API credentials into outbound requests at runtime, ensuring that your sensitive secrets are never exposed to your code, environment variables, or logs.
The credential proxy functions as a secure intermediary for your API requests. It removes the need for you to manage or hardcode secrets within your workflow logic.
Configure in settings: Connect your applications (e.g., GitHub, AWS, Anthropic) in the connectors section of the platform.
Write standard code: Write your workflow logic using your preferred language and libraries (e.g., Python's
requestsorboto3). You do not need to use special SDKs or manually inject headers.Automatic injection: When your workflow makes an API request, our proxy intercepts it, matches it to your configured connector, and securely injects the necessary credentials (headers, tokens, or signatures) before forwarding the request to the destination.
Supported authentication methods
The credential proxy supports a wide range of authentication schemes out of the box:
Bearer tokens
Basic authentication
OAuth 2.0
AWS SigV4
GitHub app JWT
Custom headers
Why do we use the credential proxy
1. Enhanced security
Your workflow code is never trusted with your actual secrets. Credentials exist only in the proxy’s isolated memory during the request lifecycle. They are never written to disk, stored in environment variables, or included in execution logs.
2. Transparent to developers
The proxy is fully transparent. You can use standard libraries exactly as you would in a local environment. There is no need to maintain complex authentication logic or custom SDKs within your code.
3. Automatic maintenance
Zero-downtime rotation: The system supports seamless credential rotation, allowing you to update keys without stopping workflows or redeploying code.
Auto-refresh: For OAuth 2.0 applications, the proxy automatically handles token refreshing and expiration tracking, so your workflows stay connected without interruption.
4. Enterprise-grade safeguards
Origin pinning: Protects against credential redirection by ensuring credentials are only sent to the intended service.
Principal scoping: Prevents cross-tenant credential leakage in multi-tenant environments.
SSRF protection: Actively blocks access to internal cloud metadata endpoints and unauthorized internal resources.