Credentials: expiry dates and rotation

Who can do thisWorkspace Administrator

Most connections sign in to an outside system with a secret: a client secret, a service account key or a password. When that secret expires, the connection stops. The Credentials page lists every credential your connections use, so you can record when each one expires and replace it in time.

The Credentials page

Open Credentials in the left rail. The page explains itself: "Every credential your connections use - what holds it, and when it expires. An expiring credential is the most common way a connection stops."

The ways of signing in are named like this:

• "Client credential - Graph" (Microsoft Intune) and "Client credential - Jamf" (Jamf Pro).
• "OAuth 2.0 - Microsoft 365", "Service account - Google" and "Basic auth - IMAP/SMTP" (shared mailboxes).
• "Basic auth (Webmercs)" (the vendor connection).
• "Operator-managed" (a secret you named yourself, for example on a REST connection).
• "None - public API" (a REST source that needs no secret).

The footer repeats the rule that matters most: "Secret values are never shown. Rotation swaps the vault entry; the connections using it pick the new value up on their next run."

Record an expiry date

The Hub cannot read the expiry date from Microsoft, Google or your mail server. You type it in, usually right after you create the secret, while you can still see its end date.

1. On the credential's row, click Set expiry (or Edit if a date is already there).
2. Pick the date in Expiry date.
3. Click Save. Clear removes the date, Cancel closes without a change.

The date names a whole day, and the status follows it:

• Active: more than 30 days left, or no date recorded.
• Expires in N days: 30 days or less left. The row turns amber.
• Expired: the date has passed. Expect the connection to fail until you rotate.
• No secret: the connection does not use a secret, so there is nothing to date.

Rows for the platform's own credentials have no Set expiry; they show Managed by Juvaro.

Rotate a credential

Rotating means giving the connection a new secret. Create the new secret in the outside system first (for example a new client secret on the app registration in Entra), then:

1. Click Rotate on the credential's row. You can also use Rotate in the Credential card on the connection's page.
2. The connection's editor opens at the secret field. The field is empty and says the secret is already set, for example "Secret set - enter a new value to rotate." (Google: "Key set - paste or upload a new one to rotate.", IMAP / SMTP: "Password set - enter a new value to rotate.").
3. Enter or upload the new secret and click Save. The editor takes you back to where you came from.
4. Record the new secret's expiry date with Edit in the Expires column.
5. Delete the old secret in the outside system once the next run has succeeded.

The connection uses the new value from its next run. Click Run now on the connection if you want to check it straight away.

Some rows have no Rotate:

• operator-managed: a secret you named yourself on a REST connection. Change it where you keep it.
• Managed by Juvaro: a platform credential, for example for user provisioning. You cannot change it in the Hub.

Members

Members can read the page, with the line "You can view connections. Only a workspace administrator can add, change, run or delete them." They see no Set expiry, Edit or Rotate, and the Webmercs credential is not listed for them at all. See What members see in the Hub.

If something goes wrong

• An empty page says No credentials yet: "Connections that hold a secret appear here - add a connector from the Marketplace."
• A refused date shows "Could not save the expiry (status): reason". See Error and validation messages.