> ## Documentation Index
> Fetch the complete documentation index at: https://rubie.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Vaulted authentication objects referenced by Blueprint runs.

Credentials are encrypted secrets Rubie stores on behalf of an end user. You
never see the field values. You receive an opaque `cred_...` id when a
[credential session](/guides/hosted-credential-collection) completes, pass that
id when [triggering a Blueprint](/guides/blueprint-runs), and revoke it when the
user disconnects.

## How you get a credential id

1. Create a session with
   [`POST /credential-sessions`](/api-reference/credential-sessions/create-credential-session)
2. Open `hosted_url` for the end user
3. Poll
   [`GET /credential-sessions/{id}`](/api-reference/credential-sessions/get-credential-session)
   (or confirm on `return_url`) until `status` is `completed`
4. Store `credential_id` against your user record

There is no list or get-credential endpoint. Retain the id yourself.

## Revocation

When an end user disconnects an integration, call
[`DELETE /credentials/{credentialId}`](/api-reference/credentials/delete-credential).
After that, triggers that reference the id will fail — create a new session if
they reconnect.

## Secrets never leave Rubie

Field values are encrypted at rest with field-level encryption. API responses
never return secret values — only opaque ids and session status. For TOTP-based
strategies, Rubie stores the secret during collection and generates codes at run
time; your servers never handle the secret.