# Credentials Credentials allow you to make API calls to a connected third-party service on behalf of a user. For OAuth integrations, WorkOS handles token refresh automatically, so you always receive a valid, non-expired token. For API-key integrations, WorkOS returns the stored secret. ## Get an access token for a connected account Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token. #### Request #### Response ## Vend credentials for a connected account Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret. #### Request #### Response ### data_integration | Field | Type | Required | Description | | --- | --- | --- | --- | | `object` | "data_integration" | Yes | Distinguishes the Data Integration object. | | `id` | string | Yes | Unique identifier of the Data Integration. | | `slug` | string | Yes | The provider slug for this Data Integration. | | `integration_type` | string | Yes | The integration type derived from the provider. | | `description` | string | No | An optional description of the Data Integration. | | `enabled` | boolean | Yes | Whether the Data Integration is enabled. | | `state` | "valid" \| "invalid" \| "requested" | Yes | The state of the Data Integration. | | `scopes` | string[] | No | The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. | | `redirect_uri` | string | Yes | The OAuth redirect URI to register with the provider when configuring the custom application. | | `credentials` | object | Yes | The credentials configured for the Data Integration. | | `custom_provider` | object | No | The OAuth definition when this is a custom provider; `null` for built-in providers. | | `created_at` | string | Yes | An ISO 8601 timestamp. | | `updated_at` | string | Yes | An ISO 8601 timestamp. | ### POST /data-integrations/{slug}/token #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `slug` | string | Yes | The identifier of the integration. | #### Returns | Field | Type | Description | | --- | --- | --- | | `active` | boolean | Indicates whether the access token is valid and ready for use, or if reauthorization is required. | | `access_token` | object | The [access token](/reference/pipes/access-token) object, present when `active` is `true`. | | `error` | "needs_reauthorization" \| "not_installed" | - `"not_installed"`: The user does not have the integration installed. `"needs_reauthorization"`: The user needs to reauthorize the integration. | ### POST /data-integrations/{slug}/credentials #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `slug` | string | Yes | The identifier of the integration. | #### Returns | Field | Type | Description | | --- | --- | --- | | `active` | boolean | Indicates credentials are available. | | `credential` | object | The credential object containing the vended secret. | | `error` | "not_installed" \| "needs_reauthorization" | The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully. `"not_installed"`: The user does not have the integration installed. `"needs_reauthorization"`: The user needs to reauthorize the integration. |