nthbouncer
Log inGet started

Credentials

Introduction

Credentials are upstream API secrets for managed pools. You enter a secret once. The dashboard never keeps it, not even a hash, and never echoes it back. The pool encrypts it on save and decrypts it only inside an isolated sandbox to reach your origin. Attach one credential to any number of managed pools; rotating it updates every pool that uses it.

Manage credentials under Credentials in the dashboard.

Create a credential

  1. Open Credentials → Add credential.
  2. Name it and choose an auth method (bearer, basic, API key, OAuth 1.0, OAuth2 client-credentials, or OAuth2 refresh token).
  3. Enter the secret fields and save.

Attach to a pool

On a managed pool's Settings, select the credential. It applies to new requests within a few seconds.

Pass-through pools do not use credentials. Callers supply upstream auth on each request.

OAuth 2.0 client credentials

Choose how the pool authenticates at the token URL:

  • Client secret — HTTP Basic with client id and secret (default).
  • Private key JWT — the pool signs a short-lived JWT (private_key_jwt) and posts it as client_assertion. Paste a private key, or use Generate certificate to mint an RSA key plus a self-signed public certificate. Download the certificate for IdPs that ask you to upload one (for example NetSuite OAuth 2.0 M2M). After mapping, paste the IdP’s certificate id into Certificate ID (kid). Algorithm defaults to PS256; RS256 and ES256 are also available.

The private key is sealed at the pool like any other secret. The public certificate is shown once for download and is not stored.

OAuth 2.0 refresh token

Use this when the origin issues access tokens from a stored refresh token instead of a client-credentials grant. Amazon SP-API (Login with Amazon) is the usual case: one developer app, one refresh token sealed at the pool, many callers with pool keys.

Set the token URL and the header the access token is attached as. For Amazon SP-API that is https://api.amazon.com/auth/o2/token and x-amz-access-token. The pool exchanges the refresh token, caches the access token, and attaches it as that header. Callers never see the refresh token or client secret.

See Front Amazon SP-API.

Rotate

Rotate from the Credentials page. Pools that reference the credential pick up the new secret within a few seconds without changing pool keys or client config.

Next steps