Authentication
Comparing API keys with delegated and application access
Choose a workflow credential by asking whose authority the action should use and what it must be able to do.
Section
Authentication
Authentication
Keeping secrets out of workflow logs
Workflow logs should explain what happened without exposing credentials.
![Restrict connector access to essential records: Grant API and record permissions only for required data types and operations.; Use HubSpot’s 'Their [Objects]' setting to limit contact access to owned records.; Verify token claims via jwt.ms to confirm restricted permissions in Microsoft Entra. Limiting a connector's access to required records](/covers/limiting-a-connector-s-access-to-required-records-640.webp?v=5f285ac7)
Authentication
Limiting a connector's access to required records
A connector should read or change the smallest useful set of records.
Authentication
Recording who approved a sensitive action
Record the actual approval responder, the terms reviewed and the separately confirmed result of the sensitive action.
Authentication
Workflow authentication and secrets
A workflow should have only the access it needs, keep its credentials out of logs and survive planned rotation without silent failure.