UiPath Documentation
integration-service
latest
false

Integration Service user guide

Use credential assets for connections

Instead of entering values directly when creating connections, you can reference Orchestrator assets. For secret fields such as passwords, API keys, and client secrets, Integration Service resolves a Credential asset through Orchestrator from a linked external vault and never stores the value in the Integration Service database. For other fields, the value is read from a standard Orchestrator Text, Bool, or Integer asset.

This feature is designed for organizations with centralized configuration management requirements, or with strict security and compliance policies around credential handling.

How it works​

Credential assets (secret fields)​

When a connection uses a Credential asset, Integration Service calls Orchestrator, which retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If the credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Text, Bool, and Integer assets (other fields)​

When a connection uses a Text, Bool, or Integer asset, Integration Service reads the value from Orchestrator. No external vault is involved.

Note:

The asset types shown in the picker depend on the field. Secret fields such as Password, API Key, and Client Secret show only Credential assets. Other supported fields show Text, Bool, and Integer assets. Drop-down fields do not show the picker. OAuth 2.0 access and refresh tokens are still stored in Integration Service after the initial authorization flow, because the OAuth protocol requires more than a client secret to authenticate. You can use a credential asset for the client secret field in BYOA (Bring your own OAuth 2.0 app) authentication types, but not for the resulting OAuth tokens.

Prerequisites​

  • Integration Service is enabled and provisioned for your tenant.
  • If using Credential assets for secret fields: at least one credential store is configured in Orchestrator. Supported external vaults include CyberArk, HashiCorp Vault, and all others supported by Orchestrator's credential store integrations.
  • One or more Orchestrator assets are available in the folder where the connection is created. The asset type depends on the field — secret fields such as Password, API Key, and Client Secret require a Credential asset; other fields accept a Text, Bool, or Integer asset.

Step 1: Configure the credential store in Orchestrator (Credential assets only)​

If you plan to use Credential assets for secret fields, set up a credential store in Orchestrator that connects to your external vault. Skip this step if you only need Text, Bool, or Integer assets.

For instructions, see About credential stores in the Orchestrator user guide.

Step 2: Create an asset in Orchestrator​

In an Orchestrator folder, create the asset that matches the field type you want to supply:

  • For secret fields: create an asset of type Credential and link it to the secret in the credential store.
  • For other fields: create a Text, Bool, or Integer asset and enter the value directly.

For instructions, see Managing assets in Orchestrator in the Orchestrator user guide.

Step 3: Reference the credential asset when creating a connection​

  1. In Orchestrator, select a folder and navigate to the Connections tab.

  2. Select Add connection and choose the connector.

  3. On the connection creation page, locate a supported field. Secret fields (Password, API Key, Client Secret) and plain text fields (such as Client ID or Token URL) both support Orchestrator assets.

  4. Select the menu icon next to the field and select Use credential asset (for secret fields) or Use Orchestrator asset (for other fields).

  5. Select the asset you want to use. You can select assets that are either found in the folder where you are creating the connection or shared with the folder using asset links.

  6. Complete any remaining fields and select Connect.

Frequently asked questions​

Are Credential asset values fetched from the vault on every request?​

No. When a Credential asset is used, its value is cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured. Text, Bool, and Integer asset values are read from Orchestrator on each use and are not cached.

What happens when a Credential asset is rotated before the cache expires?​

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step. This applies to Credential assets only.

Are asset values stored in Integration Service?​

For Credential assets: no. Values are not written to the Integration Service database and are held in memory in an encrypted state for the one-hour cache duration only. For Text, Bool, and Integer assets: values are read from Orchestrator at the time the connection is used and are not persisted in Integration Service.

Does this work for all connectors?​

Yes. This feature works with all connectors, regardless of authentication type.

Does this apply to all fields on the connection form?​

Dropdown fields are not supported — the picker does not appear on them. On all other fields, the picker shows only the asset types compatible with that field. Secret fields such as Password and API Key show only Credential assets; other fields show Text, Bool, and Integer assets.

Which Orchestrator asset types are supported?​

The asset types available depend on the field type:

FieldAvailable asset types
Secret fields (Password, API Key, Client Secret)Credential
Other fieldsText, Bool, Integer

Which external vaults are supported?​

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores. External vaults apply to Credential assets only — Text, Bool, and Integer assets store their values directly in Orchestrator.

Is proxy supported?​

Yes. Both connected and disconnected proxy configurations are supported.

Can I use a credential asset for OAuth tokens?​

No. OAuth 2.0 access and refresh tokens are always stored in Integration Service after the initial authorization flow. Only secret-type input fields on the connection screen (such as Client Secret in BYOA authentication) can reference a credential asset.

Was this page helpful?

Connect

Need help? Support

Want to learn? UiPath Academy

Have questions? UiPath Forum

Stay updated