Stored secrets in connector forms

Every connector signs in with something: a password, a private key, a secret access key, a service account key or a signing secret. For most connectors each value lives in its own field on the connection form and is never shown again once saved. This page explains how a stored value behaves and when the form asks for it again; the vault a Connect Anything connector uses for named secrets is on Connector secrets.

How a stored value behaves

• Once a value is saved, the field reads Stored password, Stored client secret, Stored private key or Stored certificate, with Replace beside it. The form shows only that a value is stored; the value itself is never shown again.
• Replace clears the box and focuses it so you can type a new value. If you change your mind, Keep the stored password (the wording follows the kind of value, for example Keep the stored key) falls back to the stored one.
• Show password and Hide password reveal and hide what you are typing, so you can check a new value before saving. Fields that take key material, such as a private key block, accept several lines.
• Generate appears on some fields and fills the box with a new value for you to copy and use; the questions below take it further.
• The copy control appears only while the box holds a new value that is not stored yet; a saved value cannot be copied, because it cannot be read.
• Leave the stored value as it is and save: the connection keeps using it. You enter a value again only when the form asks you to re-enter it.

The same rules cover every kind of credential: a database password or certificate, a Snowflake private key and its passphrase, a Microsoft Entra client secret, a secret access key on an S3 or remote file source, a webhook token or signing secret, and a service account key.

When the form asks for a value again

• Settings that identify the connection can invalidate a stored value: the host, the database URL, the account, the username, or a file source's endpoint, region, bucket or access key ID. When one changes, the stored value no longer applies, so the form clears it and asks again, naming the field.
• The warning follows one shape, "The {field} changed. Enter the {noun} again.", and reads, for example: "The host changed. Enter the password again.", "The database URL changed. Enter the service account key again.", "Enter the secret access key again: the endpoint, region, bucket or access key ID changed", "Enter the signing secret again: this connection has no stored signing secret to keep." or "Enter the password (or key) again: the server changed."
• Whether a host change alone asks for the value again is set by Require re-entering connector secrets after a host change in System settings. It is off by default. Connect a SQL database walks through this flow on a database form.
• Changing only the port is not treated as a host change, and a value you type yourself simply replaces the stored one.
• File sources check the server identity on every save, so a changed endpoint, region, bucket or access key ID asks for the secret access key again even with the setting off.
• Some changes clear a value by design: switching the sign-in method, for example Snowflake between key pair and password, clears the value that method does not use.
• If the check runs when you save or test instead of while you edit, the result is the same: the form clears the masked field and shows the warning, and you enter the value once more.

Service account keys (Google connectors)

Several Google sources, such as Google BigQuery, Firestore, Realtime Database and Google Analytics, sign in with a service account key instead of a password or a private key.

• Add the key with Choose File, drop it on Drop the service account JSON key here ("or browse to pick the file"), or click Paste the JSON instead, paste the contents and click Use this key. Cancel closes the paste box without using it.
• A key must contain private_key, client_email, project_id and token_uri. A file that is not JSON is refused with "The key is not valid JSON", and JSON that is not a service account key is refused with a message that reads This is not a service account key ("type" must be "service_account"). A key that misses one of the fields is refused too, and the message names what is missing.
• A saved key shows as a card: the header reads Stored key, and the rows read Client email, Project and Key ID. Replace takes a new file or pasted JSON, and Keep the stored key falls back to the stored one.
• A stored key behaves differently from a stored password: it is a small document, so it returns to the field as formatted JSON with its private key hidden, and the non-secret parts stay readable. A stored password or certificate has no readable content at all.
• In review rows the key summarises as Not set, Stored key or New key with a short prefix of its id, rather than as JSON.

The vault for custom connectors

A custom connector keeps named secrets in its Secrets Vault and references each one from its configuration as {{secret:NAME}}, standing alone as the whole value of its setting. The vault's steps, its actions and its name rules are on Connector secrets.

Protect a file that holds credentials

• On a custom connector, right-click a file in the connector code editor and choose Protect. A protected file becomes read-only, its credential values are hidden, and it is left out of connector downloads; uploads never overwrite it.
• Protection is permanent: there is no way to unprotect a file, so protect only files that hold credentials.

Who can change these values

• Entering or replacing a stored value needs Add/Modify Lake Objects.
• The full list is on Who can do what in the Lake.

Questions, answered

Why does the field show Stored password instead of my value?

Because a value is saved for it. Stored values are write-only: no screen shows the value again, to anyone, including you. Click Replace to type a new value; keep your own copy of any value you may need later.

If I save without re-typing the password, is it kept?

Yes. Leave the stored value as it is and save; the connection keeps using it. You retype a value only when the form asks you to re-enter it, for example after an identity field changed.

I clicked Replace by mistake. Can I keep the stored value?

Usually yes. Click Keep the stored password, or the matching wording such as Keep the stored key, and the stored value stays. If an identity field changed and the re-entry setting is on, that option is replaced by the re-entry warning, and you must enter the value again.

Which changes make the form ask for a secret again?

The fields that identify the connection: the host, the database URL, the account, the username, or a file source's endpoint, region, bucket or access key ID. When one changes, the stored value no longer applies, so the form clears it and the message names the field, for example "The host changed. Enter the password again.". Changing only the port does not trigger this. Whether a host change alone asks for the value is set by Require re-entering connector secrets after a host change in System settings; the setting is off by default. File sources check the server identity on every save.

What is the difference between a stored password and a stored key?

A password or certificate is a single value: it is hidden completely and replaced by typing a new one. A service account key is a small document: a stored key returns to the field as formatted JSON with its private key hidden, so the project, email and key id stay readable, and Replace takes a new file or pasted JSON.

Do other connectors have a vault like Connect Anything?

No. Named vault secrets belong to a custom connector's configuration, where a setting can point at {{secret:NAME}}; the vault itself is on Connector secrets. Every other connector keeps each credential in its own field and uses the stored-value behaviour above; Connect Anything (custom connector) shows the flow.

Can I copy a stored secret into another tool?

Not the value, because a stored value cannot be read. The copy control appears only while a new, unsaved value is in the box. In the vault, Copy reference copies the {{secret:NAME}} text that points at the secret, not the secret itself.

What does Generate do next to a secret field?

It creates a value for you. Click it and the field fills with a new value, ready to copy to the service that must present it, for example a webhook sender, and you save the connection afterwards. Once saved, the value is never shown again. For a webhook changeover, Webhook and RabbitMQ covers keeping the old secret working.