OAuth Credentials

Credential Manager is LyftData’s generic OAuth substrate. It stores OAuth provider and client configuration, creates activation sessions, refreshes tokens where supported, and binds the resulting credential to allowed jobs and workers. Provider-specific business operations belong to the component or Provider Pack that uses the credential.

Applies to

OAuth activation and source binding are Beta Enterprise capabilities for single-node and distributed-worker deployments. Plain secrets and TLS bundles remain available without OAuth Credential Manager; see Secrets and TLS bundles.

Before you begin

Collect the following from the provider or the setup guide for the integration:

• the provider template or authorization and token endpoints;
• the OAuth client ID and, for a confidential client, its client secret;
• the grant or activation mode;
• required scopes and audience;
• tenant-specific consent requirements; and
• the jobs and workers that should receive the credential.

Provider consent, tenant policy, scope approval, and provider availability remain controlled by the provider. Creating a record in LyftData cannot grant access the provider has denied.

Create a credential

You need platform-administrator access.

1. Open Credentials, then select the Credentials tab.
2. Select New credential.
3. Choose a built-in template or define the provider endpoints supplied by the integration owner.
4. Select an existing OAuth client record, or create one from the provider’s client ID and client type.
5. Give the credential a descriptive name and set its allowed scope policy, activation mode, and refresh strategy.
6. Save and open the credential detail page.

Use one credential per distinct provider identity and policy boundary. Avoid sharing a broad credential across unrelated jobs merely because the provider permits it.

Choose an activation mode

Mode	Use it when	Operator action
PKCE	A user completes an interactive browser authorization flow	Open the authorization URL and complete provider consent before the session expires
Device code	A browser cannot return directly to the LyftData host	Open the verification URL, enter the code, and wait while LyftData polls at the provider’s required interval
Client credentials	A service principal performs app-only operations	Store the confidential client secret in the OAuth client record and activate without user consent

The exact modes available depend on the selected provider/template. Do not convert a public PKCE or device-code client into a confidential client just to work around provider configuration. Correct the provider’s public-client setting instead.

Activate and verify

1. On the credential detail page, select Activate.
2. Complete the provider flow shown in the activation card.
3. Wait for the activation status to become Succeeded.
4. Review activation history and credential insights.
5. Configure job and worker bindings.
6. Run a bounded provider read or other non-destructive check through the intended job.

Activation history is evidence that the configured OAuth exchange completed. It does not prove every scope is usable, every worker can receive the credential, or the provider is currently available.

Device-code status

authorization_pending normally means the provider is waiting for the user to finish. slow_down means the client must poll less frequently. Let the UI follow the provider interval rather than repeatedly restarting the session.

If Microsoft Graph returns AADSTS7000218 or invalid_client for a PKCE or device-code profile, enable Allow public client flows on the app registration and start a new activation. Adding a client secret is not the fix for those public-client modes.

Use the credential from a job

Supported components accept a Credential Manager ID instead of a plaintext token. For example:

input:
  http-poll:
    url: https://api.example.com/v1/events
    auth:
      oauth2-via-credential-manager:
        credential-id: "2b64d2a0-0b76-4cd0-9ef0-3f0ef3d2a9a1"
        credential-scope-mode: allowed
    payload-mode: json

Use credential-scope-mode: custom only when the component requires an explicit subset and the job binding permits it. See the http-poll DSL reference for the generated field contract.

Automation boundary

The supported product API exposes creation, activation, binding, and inspection operations under /api/credential-manager. The shipped CLI can list, create, inspect, bind, and complete selected activation flows, but its exact grammar changes more often than the resource model. Use lyftdata credentials --help from the installed binary before scripting it.

Never pass access or refresh tokens directly on the command line. Where the installed help offers stdin or file inputs, use those paths and protect the source file. See CLI and Product API for the supported automation boundaries.