INTEGRATIONS & APIS

Connect CredSecure to Your Business Applications

CredSecure helps applications securely access the credentials they need and supports delivery of credentials to configured target systems — reducing manual handling and improving governance.

How It Works

Two Ways to Integrate

API retrieval and target-system provisioning are separate, complementary integration paths.

Integration Path 1

Applications Retrieve Credentials

Instead of manually distributing sensitive configuration files, applications can securely retrieve their permitted credential information through CredSecure APIs. The application authenticates using an assigned API client and retrieves only the credentials it is authorized to access.

1
Application authenticates
Using assigned API client credentials
2
CredSecure validates
Authorized client, scope and environment
3
Application retrieves
Permitted credential configuration via API
4
Access is audited
Every retrieval is logged centrally
Supported Authentication Methods
OAuth 2.0 Client Credentials flow
Mutual TLS (mTLS) certificate verification
HMAC request signature validation
Per-endpoint configurable rate limiting
See Application Provisioning Use Case
Integration Path 2

CredSecure Delivers Credentials

Supported integrations can send credential information to configured target systems, reducing manual handling and helping teams manage updates. Vendors or administrators create credentials in CredSecure, and CredSecure provisions the applicable security material to the connected target.

1
Administrator configures target
Set up the integration target in CredSecure
2
Credential is created or updated
By an authorized user or vendor in CredSecure
3
CredSecure provisions
Security material sent to the configured target
4
Activity is audited
Creation, sync and access are fully logged
Benefits
Reduce manual credential handling by internal teams
Allow vendors to onboard credentials directly in scope
Maintain full governance and audit traceability
Keep credential values out of email or chat channels
See BTP Provisioning Use Case
Integration Availability

Integration Matrix

Understanding what is available today, what works through standard APIs, and what can be explored as a custom integration.

Honest integration availability: The table below distinguishes between integrations that are implemented today, systems that can connect using standard CredSecure APIs, and possibilities that require further evaluation. We do not list vendor logos as pre-built integrations unless the corresponding integration is actually implemented.

System / Platform
Availability
Notes
SAP BTP Integration Suite
Implemented
Security material provisioning to BTP Integration Suite is a supported, implemented integration.
Applications supporting CredSecure REST APIs
Available via API
Applications integrated with CredSecure can retrieve authorized credentials via the REST API using OAuth 2.0, with progressive tiers adding mTLS and HMAC request signing.
CI/CD Pipelines
Available via API
Deployment pipelines can retrieve credentials through the CredSecure API at runtime or deployment.
Enterprise Integration Platforms
Explore with us
Organizations can discuss their systems and requirements to evaluate additional provisioning integrations.
Custom Target Systems
Custom development
Additional target-system integrations can be explored through co-innovation based on your architecture and requirements.
Defense in Depth

Layered Security Tiers: Standard, Secure, and Enterprise

CredSecure API access is governed by progressive, layered security tiers. Machine-to-machine integrations authenticate via OAuth 2.0, with higher tiers adding mutual TLS verification and cryptographic HMAC request signing.

Standard Tier

OAuth 2.0 Alone

OAuth 2.0 Client Credentials

Applications authenticate with encrypted client credentials to obtain short-lived, scoped JWT access tokens. Establishes machine identity and RBAC context for standard machine-to-machine integrations.

Secure Tier

OAuth with mTLS

OAuth 2.0 + Mutual TLS

Combines OAuth 2.0 bearer authorization with TLS certificate verification (x-client-verify). Ensures requests originate strictly from authorized client hardware or instances, which helps reduce unauthorized use and replay risks when correctly configured.

Enterprise Tier

OAuth + mTLS + HMAC

Complete Layered Defense

The highest protection level: OAuth 2.0 authentication and mTLS certificate verification are layered with HMAC-SHA256 request payload and timestamp signing, which strengthens request integrity and helps reduce unauthorized use and replay risks when correctly configured.

API Retrieval Pipeline: Tiered Enforcement
Enterprise Tier Active
# Step 1: Obtain scoped JWT token using client credentials
POST /oauth/tokenPayload: { "client_id": "app_client_...", "client_secret": "..." }
# Step 2: Layered retrieval with mTLS verification + HMAC request signing
GET /api/v1/credentials/retrieve?id=cred_8f29c
Authorization: Bearer <jwt_access_token> # Scoped OAuth bearer token
X-Client-Verify: SUCCESS # Mutual TLS certificate validated
X-Api-Signature: <hmac_sha256_hex> # Signed path + timestamp with client secret
X-Api-Timestamp: 1729505400 # Sliding window replay protection
✓ Every retrieval undergoes identity attestation, scope filtering, rate limit evaluation, and differential audit logging.

Discuss Your Integration Requirements

Organizations can discuss their systems and requirements to evaluate additional integration possibilities. Schedule a conversation with our team.