Application Credentials

An Application Credential authenticates a downstream Application to Axec. It does not authenticate the Application to an upstream Connector.

Credential kinds

Kind	Intended client	Stored material
client_secret	Confidential client	A secret hash and safe fingerprint
public_pkce	Public client	No client secret; authorization requires PKCE S256

Operator provisioning can create either kind. Dynamic Client Registration and Client ID Metadata Documents establish public PKCE clients.

Exact credential binding

Credentials have active, revoked, or expired status. Axec retains credential history and binds Grants, authorization artifacts, and tokens to the exact credential identity used.

This makes rotation a change in authority rather than a silent value update:

old credential revoked
  -> replacement credential receives a new identity
  -> authority bound to the old identity stops passing live checks

Keep credential roles separate

Axec handles several kinds of credentials, but they are not interchangeable:

• An Application Credential proves which downstream Application is calling.
• A Connection holds one User’s upstream account authority.
• A workspace Vaulted Credential supplies workspace-owned upstream authority.
• A Connector OAuth client credential authenticates Axec itself to an upstream authorization server.
• A Service Account credential is exchanged for a management API token.

See Grants and GrantBundles for how credential restriction affects issued tokens.