# Credential security

> How Datastruct stores, isolates, and uses credentials for external data vendors

When Datastruct stores an application programming interface (API) credential
for a data vendor, the credential is kept outside application code, databases,
and configuration. Each credential is stored as an individual secret in AWS
Secrets Manager, a vault service for sensitive values.

## Storage and encryption

AWS Secrets Manager encrypts each secret at rest with AWS Key Management
Service (AWS KMS). Connections to Secrets Manager use Transport Layer Security
(TLS), which protects the credential in transit.

Datastruct systems persist the secret's name rather than its value. The stored
credential value remains in Secrets Manager. The Data Serve service retrieves
it into memory only when it needs to make an authorized vendor request.

## Credential isolation

Secret names separate credentials by environment, AWS region, organization,
vendor product, and individual credential. A credential belongs to one
organization and is not pooled or shared with another customer.

This structure makes the organization boundary part of credential resolution,
not only an application convention.

## Runtime access

At runtime, only the Data Serve service's AWS Identity and Access Management
(IAM) role can retrieve vendor secrets. The role can read a secret's value and
metadata only within the Data Serve secret namespace for that environment.
Other applications, pipelines, and services do not receive runtime read access
to that namespace.

## Credential use during an API request

Every Data Serve request must include a valid machine-to-machine token and
workflow identifier. Authentication happens before Data Serve resolves a vendor
credential.

The validated token identifies the caller's organization. Data Serve does not
accept an organization identity from the request body. The organization and
workflow determine which credential path the service can resolve, so a caller
cannot select another organization's stored credential.

Data Serve uses the credential server-side to call the vendor. A stored secret
value is not included in the API response, and request logs redact credential
material.

This protection applies to credentials stored by Datastruct. Sending vendor
credential fields directly in an API request has different response and logging
considerations. See the source configuration reference before using that
option.

## Operational guardrails

Credentials enter Secrets Manager through a controlled operator process. They
are never committed to source control. Secret deletion uses a seven-day
recovery window by default, allowing an accidental deletion to be reversed
during that period.

## Related reference

- [Authentication](/docs/api/data-serve/authentication/) defines the caller
  token and workflow contract.
- [Source configuration](/docs/api/data-serve/data-sources/) defines stored
  credential references and credential resolution.
- [Introduction to Datastruct](/docs/topics/) gives a high-level overview of
  how Datastruct discovers, tests, and integrates external data.