Authentication method management
Authentication methods avoid repeating access to a third-party system in every node: the authentication scheme is centralized, encrypted and masked, and Ecosystem applies the access at execution time. This is the reference trade-off for knowing where a secret goes. To create and configure methods, see Authentication methods.
Why centralize
- Centralization: access is configured in a single place.
- Performance: with an expiration date (OAuth 2, Custom), Ecosystem keeps tokens in memory and manages their refresh — instead of generating a token on every execution.
- Security: secrets are stored encrypted and masked.
- Maintenance: modify once, all workflows using the method are updated.
How it fits together
- One method per system —
oauth-salesforce,basic-erp,api-stripeinstead of an all-in-one method: traces and secret rotation are easier to read. - Naming reflects the system:
[type]-[system]-[environment](e.g.oauth-salesforce-prod) when distinct environments share the same system. - What Ecosystem applies, by type:
| Type | What Ecosystem does |
|---|---|
| Basic Auth | Adds Authorization: Basic xxx |
| OAuth 2 | Manages the token, refreshes it, adds Authorization: Bearer xxx |
| Custom | Applies your custom configuration |
Authentication methods vs dictionaries
Both spaces can contain secrets. The difference is not "secret → authentication method, config → dictionary", but what is centralized:
| Space | Main role | Secrets? |
|---|---|---|
| Authentication methods | Centralize an encrypted and hidden authentication scheme (Basic, OAuth 2, API Key, Custom), reused by several nodes. | ✅ Encrypted and hidden values. Fields can reference {{dictionaries.nomDuDico.cleDuDico}}. |
| Dictionaries | Centralize per-environment variables (URLs, timeouts, but also keys and tokens), hideable in the interface. | ✅ Values can be hidden, reusable in node fields and authentication method fields. |
What goes into an authentication method:
- an auth scheme used by several nodes (Basic Auth, OAuth 2, API Key, Custom);
- a secret tied to an auth mechanism managed by Ecosystem (OAuth 2 refresh, Basic encoding);
- certificates, private keys and passphrases tied to a connection.
What goes into a dictionary:
- a value that varies by environment (dev, staging, production);
- a value reused in several fields (URL, headers, parameters, authentication method fields);
- a secret to mask in the interface (
{{dictionaries.nomDuDico.cleDuDico}}).
A secret is stored either in an authentication method (if an auth scheme is centralized) or in a hidden dictionary. In both cases, never enter it in clear text in a node. You don't have to choose: an authentication method centralizes the auth scheme, and the secrets it uses live in a hidden dictionary — the workflow is never modified when a secret rotates.
Varying secrets by environment
The fields of an authentication method accept dictionary variables: instead of a fixed value, enter {{dictionaries.nomDuDico.cleDuDico}} so that each environment uses its own secret without duplicating the method.
| Method field | Entered value |
|---|---|
| Client identifier | {{dictionaries.oauth.clientId}} |
| Client secret | {{dictionaries.oauth.clientSecret}} |
| Token URL | {{dictionaries.oauth.tokenUrl}} |
What to know before you start
- Secret rotation — create the new secrets in the third-party system, update the method (or dictionary) in Ecosystem, test in DEV: workflows automatically use the new secrets, without modifying the workflow.
- Never enter a secret in clear text in a node or in a versioned workflow. Leave a secret field of an authentication method empty so Ecosystem uses the corresponding dictionary variable.
- Configure URLs as dictionary variables (
{{dictionaries.nomDuDico.cleDuDico}}) to resolve values dynamically per environment — see Dictionaries.
- Authentication methods are configured for all environments
- Names are explicit and consistent
- Secrets referenced by methods are populated in dictionaries (hidden values) or in the method itself
- DEV tests validate the authentication
Go further
See also: Authentication methods