Credentials
Introduction
Credentials are upstream API secrets for managed pools. You enter a secret once. The dashboard never keeps it, not even a hash, and never echoes it back. The edge encrypts it on save and decrypts it only inside an isolated sandbox to reach your origin. Attach one credential to any number of managed pools; rotating it updates every pool that uses it.
Manage credentials under Credentials in the dashboard.
Create a credential
- Open Credentials → Add credential.
- Name it and choose an auth method (bearer, basic, API key, OAuth 1.0, OAuth2 client-credentials, or OAuth2 refresh token).
- Enter the secret fields and save.
Attach to a pool
On a managed pool's Settings, select the credential. It applies to new requests within a few seconds.
Pass-through pools do not use credentials. Callers supply upstream auth on each request.
OAuth 2.0 refresh token
Use this when the origin issues access tokens from a stored refresh token instead of a client-credentials grant. Amazon SP-API (Login with Amazon) is the usual case: one developer app, one refresh token sealed at the edge, many callers with pool keys.
Set the token URL and the header the access token is attached as. For Amazon
SP-API that is https://api.amazon.com/auth/o2/token and
x-amz-access-token. The edge exchanges the refresh token, caches the access
token, and attaches it as that header. Callers never see the refresh token
or client secret.
See Front Amazon SP-API.
Rotate
Rotate from the Credentials page. Pools that reference the credential pick up the new secret within a few seconds without changing pool keys or client config.