Documentation / Credentials / Use credentials

Set up a credential provider

Install a provider package, configure its application details, and securely bind bootstrap secrets.

how-toFor tenant administrators, operatorsOwner Constal platform teamVerified 2026-08-20

A provider package defines lifecycle code. Setting it up creates a configured provider instance in one namespace. One installed instance can create many output Credentials.

Before you begin

  • Create the external application or service account required by the integration.
  • Collect its non-secret identifiers and required secrets.
  • Register any callback URL shown by the Console exactly as displayed.
  • Confirm the package's intended authority and required external permissions.

Steps

  1. Open Credentials, then Providers.
  2. Select Add provider.
  3. Choose the authentication behavior, not merely the service name.
  4. Enter the required application details. These are rendered from the package configuration schema.
  5. Paste each bootstrap secret, or select an existing Credential when the same application secret is already governed in this namespace.
  6. Expand Advanced options only when you need a second provider instance or a custom Resource name.
  7. Select Set up provider.

Inline secrets are converted into separate encrypted Credentials before the immutable provider Resource is registered. Provider code receives them only through its declared bootstrap slots.

Verify

The completion view should identify the provider as ready. In the Providers tab, confirm its provisioning behavior and Credential count. Create a first Credential and verify the expected behavior:

  • authorization provider: a browser authorization begins;
  • mint provider: material is created and verified;
  • import provider: operator material becomes active immediately.

Multiple instances

Install multiple instances when a tenant owns multiple external applications, regions, or security domains. Give each instance a unique name and bind the correct instance when creating Credentials. Package code remains immutable; instance configuration and bootstrap Credentials differ.

Troubleshooting

  • No provider choices: install a private package or ask the platform administrator to make a managed package available.
  • Callback mismatch: copy the exact HTTPS callback without parameters or a trailing variation.
  • Bootstrap Credential conflict: choose a new provider instance name or select the intended existing Credential.
  • Package rejected: review Provider package format.

Next steps

Create a Credential, then follow Use a credential from an agent.