Connection security

Where credentials live, what is never shown again, and what Hawi will not do with a secret.

Provider credentials are held against your account and encrypted at rest. They are not copied into workspace records, are not readable from the browser, and are not returned by any API — including the developer API, which has no scope that could ask for one.

What you can and cannot see

You can see that a connection exists, what it is for, and which workspaces have selected it.
You can see the read and write scope it grants, before and after adding it.
You can see a hint — enough characters to tell two credentials apart — and never the value.
You cannot retrieve a secret after supplying it. If you have lost it, replace it rather than recovering it.

Redaction in traces

Connector secrets are redacted from the run trace before it is stored, not before it is displayed. That ordering matters: a value redacted at display time is still in the record for anybody who reaches the record another way.

Connection security

Where credentials live, what is never shown again, and what Hawi will not do with a secret.

What you can and cannot see

You can see that a connection exists, what it is for, and which workspaces have selected it.
You can see the read and write scope it grants, before and after adding it.
You can see a hint — enough characters to tell two credentials apart — and never the value.
You cannot retrieve a secret after supplying it. If you have lost it, replace it rather than recovering it.