Credentials

Vaulted authentication objects referenced by Blueprint runs.

Credentials are encrypted secrets Rubie stores on behalf of an end user. You never see the field values. You receive an opaque cred_... id when a credential session completes, pass that id when triggering a Blueprint, and revoke it when the user disconnects.

How you get a credential id

1. Create a session with POST /credential-sessions
2. Open hosted_url for the end user
3. Poll GET /credential-sessions/{id} (or confirm on return_url) until status is completed
4. Store credential_id against your user record

There is no list or get-credential endpoint. Retain the id yourself.

Revocation

When an end user disconnects an integration, call DELETE /credentials/{credentialId}. After that, triggers that reference the id will fail — create a new session if they reconnect.

Secrets never leave Rubie

Field values are encrypted at rest with field-level encryption. API responses never return secret values — only opaque ids and session status. For TOTP-based strategies, Rubie stores the secret during collection and generates codes at run time; your servers never handle the secret.