# Manage connector credentials

Every connector authenticates to its source system with credentials that you
provide — for example, a client secret for Microsoft Entra ID, an API token for
Okta, or a client secret and refresh token for Workday. This page explains how
Mesh handles those secrets, how an expired or revoked credential shows up, and
how to plan rotation and revocation.

## How Mesh handles connector secrets

- **Secret fields are write-only.** Fields such as client secrets and API
  tokens are never displayed back after you save them. You can replace a stored
  secret by entering a new value, but you can't view the current one.
- **Encryption.** At the platform level, Axiad encrypts sensitive data at rest
  and in transit — see the [Axiad Trust Center](https://trustcenter.axiad.com/)
  for Axiad's security controls and documentation.

Because Mesh never displays a stored secret, the source system is where you
mint a replacement: if a secret is lost, create a new one in the source system
and update the connector configuration.

> **warning**

Microsoft shows an Entra ID client secret **Value** only once, immediately
after you create it. Copy it into Mesh before you leave the Microsoft portal —
otherwise you need to create a new client secret. For the full walkthrough, see
[Complete your Marketplace onboarding](../getting-started/complete-onboarding.md).

## How credential expiry shows up

When a credential expires or is revoked in the source system, the connector can
no longer authenticate, and data collection stops. Mesh reports this through
connector health:

- **A connector with bad credentials isn't shown as working.** Mesh verifies
  credentials with a real authentication check, and a connector is only marked
  **Enabled** after that check succeeds.
- **Microsoft Entra ID.** If authentication stalls after setup, an explicit
  failure state appears in connector health within 30 seconds, and the error
  includes the specific error code from Microsoft when available.
- **Workday.** Collection failures are recorded, and the reason appears in the
  connector health view, so you can see why a sync is stuck.

> **note**

Mesh surfaces authentication failures after they happen. To avoid a gap in
collection, record each credential's expiry date in your own rotation calendar
and rotate before the credential lapses.

## Rotate a credential on an existing connector

Use the following general procedure to replace a secret on a connector that's
already configured. The exact field names and buttons vary by connector — see
the **Authentication** section on the connector's own page for the fields it
uses.

1. Create the replacement credential in the source system first — for example,
   a new client secret in Entra ID or a new API token in Okta. Where the source
   system allows overlapping credentials, keep the old one active until Mesh is
   collecting with the new one.
2. In the Mesh dashboard, open **System configurations > Connectors** and open
   the configuration of the connector you're updating.
3. Enter the new secret into the write-only secret field. The stored value
   isn't displayed; the value you enter replaces it.
4. Select **Test connection** and confirm that the test succeeds.
5. Save the configuration, then confirm in connector health that the connector
   authenticates and the next collection completes without errors.
6. After Mesh collects successfully with the new credential, revoke the old
   credential in the source system.

If anything behaves differently during rotation, contact Axiad support.

## Plan rotation for each source

- **Microsoft Entra ID** — you choose a client secret's expiration when you
  create it, and Microsoft imposes a maximum lifetime. See Microsoft's guide,
  [Add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-client-secret),
  for the current options. For the connector's credential fields, see
  [Microsoft Entra ID: Authentication](../connectors/idp/microsoft-entra-id.mdx#authentication).
- **Okta** — API token lifetime is governed by your Okta organization's
  policies; rotate on the schedule your policy requires. For the connector's
  credential fields, see [Okta: Authentication](../connectors/idp/okta.mdx#authentication).
- **Workday** — the connector uses an API client secret and a refresh token,
  and you set the refresh token timeout (in days) when you register the API
  client. See [Create an API client](../connectors/hr/workday-integration.md#create-an-api-client)
  and [Generate a refresh token for the API client](../connectors/hr/workday-integration.md#generate-a-refresh-token-for-the-api-client)
  on the Workday page.

When your organization rotates a source system's credentials on a schedule,
update the connector in Mesh as part of the same change window so collection
resumes promptly.

## Revoke access and disconnect

When you decommission a connector or offboard a source system, revoke the
credential in the source system as well as removing it in Mesh:

1. Remove the connector from **System configurations > Connectors** in Mesh.
2. Revoke or delete the credential in the source system — for example, delete
   the client secret (or the whole application registration) in Entra ID, or
   revoke the API token in Okta. Removing the connector in Mesh doesn't
   invalidate the credential that the source system issued, so revoking it in
   the source system ensures it can't be used anywhere.

Data that the connector already collected is governed by the Customer Data
terms in your agreement with Axiad. For questions about removing collected
data for a specific source, contact your Axiad representative.