Integration Credentials
Set vendor API credentials once at the organization level and let every team inherit them, or let a team override with its own.
If several teams connect to the same source system with the same credentials, you can enter those credentials once for your whole organization instead of repeating them in every team.
Manage them at Manage Tenant → Integrations (/home/organization/integrations). The tab is visible to organization owners and admins only.
How it works
You store one credential per vendor for the organization. When a team runs the connect wizard for that vendor, it can use the shared credential without anyone having to paste secrets again.
A team can still be given its own credentials, which take priority.
Resolution order
When the platform needs credentials for a team, it looks in this order:
- The team's own credentials, if the team has been configured to use its own and they are not empty.
- Otherwise, the enabled organization-level credential for that vendor.
- Otherwise, whatever the team row holds — which may be nothing, in which case the connection will fail.
Who can see what
| Owner | Admin | Viewer | Team member | |
|---|---|---|---|---|
| Read the stored secret | Yes | Yes | No | No |
| Add or replace a credential | Yes | Yes | No | No |
| Use the shared credential when connecting a team | Yes | Yes | — | Yes |
The last row is the useful part: a team member can complete the connect wizard against a shared credential without ever being shown the secret itself.
Setting a credential
- Go to Manage Tenant → Integrations.
- Choose the vendor.
- Enter the credential fields for that vendor — see Vendor Reference for exactly which fields each one needs.
- Save, and make sure the credential is enabled.
Replacing a credential takes effect on the next sync. It does not re-run existing syncs.
When to use shared credentials, and when not to
Use them when your teams are internal divisions of one company connecting to one instance of one source system. It is less work and there is one place to rotate a key.
Do not use them when teams represent genuinely separate entities, or when your source vendor issues per-site credentials. In those cases give each team its own credentials through the team's own Integrations page.
Rotating credentials
When you rotate a key in the vendor's system:
- Update the credential in Manage Tenant → Integrations first.
- Trigger or wait for the next sync and confirm it succeeds — see Sync and Data Freshness.
- Only then revoke the old key at the vendor.
Doing it in that order avoids a window where syncs fail silently until someone notices stale data.
What is stored
Only the credential fields the vendor connection needs — keys, secrets, client identifiers, and a site or base URL. Access is restricted to organization owners and admins by row-level security, and the values are held in Optimal Workforce's managed database, which is encrypted at rest by the platform.
Credentials are never sent to the browser for viewers or team members, and never appear in reports, exports, or Willow.
If you have a requirement for customer-managed key material or a secrets vault integration, raise it with your Optimal Workforce representative — it is not something you can configure yourself today.