How Current stores credentials and secrets

Every integration you connect hands Current a credential: an Autotask API user and secret, a ConnectWise API Member key pair and clientId, a HubSpot key, a CrewHu token, a ScalePad key, a Microsoft OAuth grant. Those credentials can read — and in your PSA's case write — real billing records. This article is the answer to "where do they live and who can read them", the question that shows up in every vendor security review. ConnectWise credentials are stored in exactly the same server-only vault as every other connector's.

Credentials are entered once, validated against the vendor's API, and stored server-side. They are never sent back to a browser — not to a Tenant Admin, not to ITPartners+ staff, not to the person who typed them in. The integrations screen reflects this: once a connector is connected, the credential fields collapse behind a replace-style control (Edit credentials on the PSA cards — Autotask, ConnectWise PSA, and HaloPSA — Reconnect on Quoter, Replace token / Replace key / Replace connection on the CRM connectors) and the form comes up blank, because there is nothing to pre-fill. Anywhere a stored key is acknowledged, you see a masked "•••• set" state, never the value.

• ＋Integration secrets (Autotask, ConnectWise, HubSpot, CrewHu, NeverBounce, ScalePad, Quoter) are held in a server-only store. Every table privilege on it is revoked from the browser-facing database roles and granted only to the server-side service role, so no signed-in session — admin or not — can read it through the API. Only server-side service code can.
• ＋Microsoft 365 tokens are per-person and live in a separate server-only table with the same lock: granted to the service role only, row-level security on, and no policy for signed-in users at all. The browser never receives an access token or a refresh token — Current's server calls Microsoft on your behalf and returns only the result.
• ＋OAuth sign-in flows use a one-time nonce that is stored bound to your user and re-checked when Microsoft calls back, then consumed, so a callback can't be forged or replayed. Redirect targets are validated server-side against a configured allowlist (or, if none is configured, pinned to the app's own https callback path), and Microsoft independently rejects any redirect URI not registered on the app — so a tampered redirect is refused.
• ＋The platform's own keys — the AI key, the fallback email-sending key, the Microsoft app secret — live in the hosting platform's secret store. They are never written into the database, never shipped to the browser, and never rendered in the UI. If a workspace brings its own email-sending key or webhook signing secret, those are stored in the same server-only, service-role-only tables as every other integration credential.
• ＋Credentials are never echoed into responses, logs, or error messages. When a vendor rejects a credential, Current reports that it was rejected — not what was sent.
• ＋Each workspace's credentials are isolated to that workspace. Current's scheduled background jobs authenticate to their own endpoints with a shared secret kept in an encrypted vault, not with your integration credentials.

Autotask, ConnectWise, Quoter, HubSpot, and NeverBounce credentials are Tenant-Admin-only. CrewHu and ScalePad can also be configured by sales leadership — a Sales Manager — because those connectors belong to the CRM. Microsoft 365 works differently: each person connects their own Microsoft account from Settings, so the token is theirs and is scoped to what Microsoft granted them. What is Tenant-Admin-only is the one-time organization-wide approval (so teammates aren't each prompted) and the underlying Microsoft app configuration. The server re-checks the role itself on every attempt rather than trusting the screen you got there from, and it explicitly excludes deactivated accounts: an offboarded admin whose browser session hasn't expired yet still cannot overwrite a live PSA credential. Non-admin staff who open the Integrations page see connection status and a banner telling them credentials are configured by a Tenant Admin — status is visible, the credential controls are not. Partners never reach it. See "Roles & permissions: who sees what".

1. 1
   Generate the new credential in the source system first

   In Autotask, that's a new secret on the API user (or a new API user entirely). In ConnectWise, mint a new API-key pair on the API Member — the private key is shown exactly once. In HubSpot, CrewHu, NeverBounce, or ScalePad, it's a new key or token. Current can't hand your old secret back to you, so don't plan on reading it out of Current to compare — if you've lost it, issue a new one.
2. 2
   Open Admin → Integrations and pick the connector

   Click Manage on the connector's card to open its drawer. The PSA cards (Autotask, ConnectWise PSA) use Edit credentials and Quoter uses Reconnect to reveal the credential form; the CRM connectors use their own replace control — Replace token (CrewHu), Replace key (ScalePad, NeverBounce), Replace connection (HubSpot).
3. 3
   Paste the new values and save

   On the PSA cards and Quoter the button is Test & save connection: Current validates the credential against the vendor and only stores it if it authenticates. The CRM connectors save the key and offer a separate check — Test connection on CrewHu, Test what this key can read on HubSpot.
4. 4
   Confirm the connector is green

   The drawer shows the connection state, and for your PSA you can open Sync details from the same drawer. Queued sync jobs pick up the new credential on their next attempt — there's no downtime and nothing to re-queue by hand. See "Reading the sync health dashboard".

Quoter delivers won quotes to Current over a webhook URL. A URL on its own is not a credential: anyone who learns it could post fake won quotes into your queue. Current supports a hash key for exactly this — set the same value on the webhook in Quoter and in Current's Quoter drawer, and every delivery is signed and checked. The stored key is shown only as "•••• set", with Replace and Remove beside it; it never comes back to the browser either. If no key is set, the drawer warns you. See "ScalePad Quoter: turn won quotes into projects and charges".

• ＋Deactivating a person cuts their access to Current immediately, but it does not rotate any integration credential — a shared PSA API credential keeps working. If the person who leaves knew the secret, rotate it in your PSA and re-enter it in Current using the steps above.
• ＋Disconnecting Microsoft 365 deletes the stored tokens for that connection. Re-connecting starts a fresh consent flow.
• ＋Use a dedicated API identity for Current — an Autotask API user or a ConnectWise API Member — rather than a human login, so the credential can be revoked on its own without disturbing anyone's access to the PSA.
• ＋Moving the workspace to single sign-on hands account revocation to Entra ID, which is the fastest offboarding path there is.