Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Manage connector credentials

Every connector authenticates to its source system with credentials that you provide — for example, a client secret for Microsoft Entra ID, an API token for Okta, or a client secret and refresh token for Workday. This page explains how Mesh handles those secrets, how an expired or revoked credential shows up, and how to plan rotation and revocation.

How Mesh handles connector secrets​

  • Secret fields are write-only. Fields such as client secrets and API tokens are never displayed back after you save them. You can replace a stored secret by entering a new value, but you can't view the current one.
  • Encryption. At the platform level, Axiad encrypts sensitive data at rest and in transit — see the Axiad Trust Center for Axiad's security controls and documentation.

Because Mesh never displays a stored secret, the source system is where you mint a replacement: if a secret is lost, create a new one in the source system and update the connector configuration.

Copy the Entra client secret when you create it

Microsoft shows an Entra ID client secret Value only once, immediately after you create it. Copy it into Mesh before you leave the Microsoft portal — otherwise you need to create a new client secret. For the full walkthrough, see Complete your Marketplace onboarding.

How credential expiry shows up​

When a credential expires or is revoked in the source system, the connector can no longer authenticate, and data collection stops. Mesh reports this through connector health:

  • A connector with bad credentials isn't shown as working. Mesh verifies credentials with a real authentication check, and a connector is only marked Enabled after that check succeeds.
  • Microsoft Entra ID. If authentication stalls after setup, an explicit failure state appears in connector health within 30 seconds, and the error includes the specific error code from Microsoft when available.
  • Workday. Collection failures are recorded, and the reason appears in the connector health view, so you can see why a sync is stuck.
Track expiry dates yourself

Mesh surfaces authentication failures after they happen. To avoid a gap in collection, record each credential's expiry date in your own rotation calendar and rotate before the credential lapses.

Rotate a credential on an existing connector​

Use the following general procedure to replace a secret on a connector that's already configured. The exact field names and buttons vary by connector — see the Authentication section on the connector's own page for the fields it uses.

  1. Create the replacement credential in the source system first — for example, a new client secret in Entra ID or a new API token in Okta. Where the source system allows overlapping credentials, keep the old one active until Mesh is collecting with the new one.
  2. In the Mesh dashboard, open System configurations > Connectors and open the configuration of the connector you're updating.
  3. Enter the new secret into the write-only secret field. The stored value isn't displayed; the value you enter replaces it.
  4. Select Test connection and confirm that the test succeeds.
  5. Save the configuration, then confirm in connector health that the connector authenticates and the next collection completes without errors.
  6. After Mesh collects successfully with the new credential, revoke the old credential in the source system.

If anything behaves differently during rotation, contact Axiad support.

Plan rotation for each source​

  • Microsoft Entra ID — you choose a client secret's expiration when you create it, and Microsoft imposes a maximum lifetime. See Microsoft's guide, Add a client secret, for the current options. For the connector's credential fields, see Microsoft Entra ID: Authentication.
  • Okta — API token lifetime is governed by your Okta organization's policies; rotate on the schedule your policy requires. For the connector's credential fields, see Okta: Authentication.
  • Workday — the connector uses an API client secret and a refresh token, and you set the refresh token timeout (in days) when you register the API client. See Create an API client and Generate a refresh token for the API client on the Workday page.

When your organization rotates a source system's credentials on a schedule, update the connector in Mesh as part of the same change window so collection resumes promptly.

Revoke access and disconnect​

When you decommission a connector or offboard a source system, revoke the credential in the source system as well as removing it in Mesh:

  1. Remove the connector from System configurations > Connectors in Mesh.
  2. Revoke or delete the credential in the source system — for example, delete the client secret (or the whole application registration) in Entra ID, or revoke the API token in Okta. Removing the connector in Mesh doesn't invalidate the credential that the source system issued, so revoking it in the source system ensures it can't be used anywhere.

Data that the connector already collected is governed by the Customer Data terms in your agreement with Axiad. For questions about removing collected data for a specific source, contact your Axiad representative.