---
id: ADR-PFM-INT-008
title: Credentials live only in secret storage and are lent briefly
product_area: platform
module: integrations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Store credential values in external secret storage and issue brief, execution-scoped in-memory leases to
  authorized adapters. Credential administration requires its own permission.
constrains:
  - DOM-PFM-INT-002
  - STATE-PFM-INT-004
  - WF-PFM-INT-003
  - WF-PFM-INT-004
  - WF-PFM-INT-005
  - SCR-PFM-INT-006
  - SVC-PFM-INT-integrations
alternatives:
  - option: Keep encrypted provider keys in ordinary database records.
    why_not: >-
      Database reads and backups would then include encrypted provider material; the existing storage boundary
      separates those values.
  - option: Grant key administration to every account manager.
    why_not: Organizations may separate account administration from replacement of provider credentials.
consequences:
  - Read operations expose metadata and a limited hint without secret values.
  - >-
    Replacement selects a new secret; seven-day recovery of the old secret depends on the external deletion
    request succeeding.
  - Database deletion alone cannot remove external credentials.
origin: docs/milestones/INTG-M1-find-install-connect.md#Decisions D5 (INTG-M1 Product Accepted)
supersedes: []
---

# Credentials live only in secret storage and are lent briefly

## Context

Account configuration and secret values have different access and retention boundaries.

## Decision

Store credential values in external secret storage and issue brief, execution-scoped in-memory leases to authorized adapters. Credential administration requires its own permission.

## Alternatives Considered

Keep encrypted provider keys in ordinary database records. Database reads and backups would then include encrypted provider material; the existing storage boundary separates those values.

Grant key administration to every account manager. Organizations may separate account administration from replacement of provider credentials.

## Consequences

Read operations expose metadata and a limited hint without secret values.

Replacement selects a new secret; seven-day recovery of the old secret depends on the external deletion request succeeding.

Database deletion alone cannot remove external credentials.