--- title: "Credential Management in Unified: Bring Your Own Secrets Manager" img: https://s3.us-east-2.amazonaws.com/unified-article-images/credential_management_in_unified_bring_your_own_secrets_manager-icon.png date: 2026-01-30T14:27:00.000Z tag: Product description: "Credential management is one of the most sensitive parts of integration infrastructure. OAuth tokens, API keys, and refresh logic determine not just whether..." url: "https://unified.to/blog/credential_management_in_unified_bring_your_own_secrets_manager" --- # Credential Management in Unified: Bring Your Own Secrets Manager ------ _January 30, 2026_ Credential management is one of the most sensitive parts of integration infrastructure. [OAuth](/embeddedauth) tokens, API keys, and refresh logic determine not just whether integrations work, but **who controls access, how failures are handled, and where risk lives**. Unified's approach to credential management is intentionally narrow and explicit: - Unified manages token lifecycle and integration behavior. - Customers control where credentials are stored. This post explains **how credential management works in Unified**, why credential ownership matters, and how Unified supports customer-managed secrets managers today. ## Credential Management in Unified Unified handles authorization and credentials across all supported integrations, including OAuth-based platforms and API-key systems. At a high level, Unified is responsible for: - Exchanging credentials during authorization - Tracking token expiration - Refreshing access and refresh tokens automatically - Handling provider-specific OAuth behavior - Isolating credentials per customer connection Applications integrating with Unified do not manage token refresh jobs, background schedulers, or provider-specific edge cases. Unified abstracts that complexity and exposes connection health consistently. Where Unified is deliberately flexible is **credential storage**. ## Unified-Managed Credential Storage (Default) By default, Unified can store OAuth tokens and API credentials **encrypted within its infrastructure**. In this model: - Credentials are encrypted at rest (AES-256) - All data in transit uses TLS 1.2+ - Token expiration and refresh are handled automatically - Applications never interact with raw credentials - Failed refreshes surface a consistent `401` and mark the connection unhealthy This option works well for many teams, especially those optimizing for speed and simplicity. However, some teams require tighter control over where credentials live. ## Customer-Managed Secrets: Bring Your Own Vault Unified also supports storing credentials **entirely inside customer-owned secrets infrastructure**, rather than Unified's database. Unified currently integrates with: - AWS Secrets Manager - Azure Key Vault - Google Cloud Secrets Manager - HashiCorp Vault When customer-managed secrets are enabled: - OAuth tokens and API credentials are stored in your cloud account - Unified accesses credentials only when required to make API calls or refresh tokens - Credentials are not persisted in Unified's core data store - Token refresh and lifecycle management remain fully automated Unified continues to manage **behavior and reliability**. Customers retain **ownership and control of the vault**. ## What This Changes — and What It Doesn't ### What changes - Credentials live inside your existing security boundary - Vault access follows your IAM and security policies - Environments can be isolated (production vs staging) - Security reviews and procurement are simplified - Credential portability is preserved ### What doesn't change - Unified does not store customer data - OAuth flows and provider requirements remain the same - No caching or persistence is introduced - Applications do not manage refresh logic This is a change in **ownership**, not architecture. ## Token Lifecycle and Failure Handling Regardless of where credentials are stored, Unified continues to handle: - Expiration tracking - Automatic access and refresh token rotation - Provider-specific OAuth behavior - Connection health monitoring If a refresh fails: - The connection is flagged as unhealthy - API calls return a consistent `401` - A connection health event is emitted so applications can respond From the application's perspective, integration behavior is unchanged. From a security perspective, responsibility is clearer. ## Why Credential Ownership Matters For many teams, vendor-managed encrypted storage is sufficient. For others, it's a blocker. Teams operating in regulated or enterprise environments consistently require: - Credentials to live in _their_ cloud - Vault access governed by internal IAM policies - Clear separation between environments - Long-term portability and reduced vendor lock-in Customer-managed secrets exist to meet those requirements **without changing how Unified operates.** ## How This Fits Unified's Architecture Unified is a real-time, passthrough integration platform: - Customer data is fetched live from source systems - Nothing is cached or stored at rest - Logs are minimized and redacted - Operational metadata is encrypted - Credential handling is isolated per connection Allowing customers to own their credential vault is a direct extension of that model. Unified avoids storing what it doesn't need to store — data or secrets. ## Who This Is For Customer-managed secrets are most relevant for teams that: - Serve enterprise customers - Undergo SOC 2, HIPAA, or GDPR reviews - Have internal security or platform teams - Operate multi-cloud or standardized vault infrastructure - Want clean exit paths and minimal vendor lock-in Unified-managed encrypted storage remains available for teams that don't need this level of control. This is about **choice**, not added complexity. ## A Clear Security Boundary Unified doesn't try to be a database, a vault, or a security platform. We focus on being **real-time integration infrastructure** — and on owning only what we need to own. Credential management is unavoidable. Credential ownership is optional. With customer-managed Secrets Manager support, that boundary is now explicit. [Start a free trial](https://app.unified.to/) or [talk to us](https://unified.to/contact) to see your real-time use case live.