Supported credential types

VendorGate stores authentication details as named credentials. When you build a pipeline or API monitor, you reference a credential by name instead of embedding secrets in the configuration.

SFTP / FTP

Use these credentials to connect to file servers.

SFTP: host, port (default 22), username, and either a password or an SSH private key.
FTP: host, port (default 21), username, password, and an optional TLS setting.

API (`api`)

Used for REST sources, destinations, and API monitors. The credential selects an authentication strategy:

API key / header: header name (default Authorization) and token prefix (default Bearer).
Bearer token: a token sent in the configured header.
Basic auth: username and password, sent as a Base64-encoded Authorization header.
OAuth2 client credentials: client ID, client secret, and token URL. VendorGate fetches a bearer token before each check.
mTLS: client certificate and key for mutual TLS authentication.
Query param: an API key sent as a query parameter.

S3-compatible storage

Stores an access key, secret key, default bucket, region, and an optional custom endpoint. This works with Amazon S3, MinIO, and other S3-compatible services.

Database

Stores the details needed to connect to a supported database: driver, host, port, database name, username, password, and SSL mode. Supported drivers are PostgreSQL, MySQL, MSSQL, and SQLite.

Webhook

Stores a webhook URL and a signing secret. Used by API Monitoring and pipeline alerts so VendorGate can send signed notifications to your own endpoints.

LLM Provider

Stores the details needed for LLM-powered mappings in standardizers: provider (for example openai or anthropic), model name, API key, and optional base URL.

Security notes

Credentials are encrypted at rest.
Secret values are never returned in API responses or displayed in the UI after creation.
Updating a credential applies automatically to every pipeline and monitor that uses it.