Workspace owners can now require that every new credential in a mabl workspace be saved as a cloud credential. Cloud credentials are write-only: an author can update the username and replace the password, but nobody can retrieve a saved password.
Previously, saving a credential as a cloud credential used to be optional, and it was up to whoever created the credential. Left unchecked, the password could be readable by anyone with the right workspace permissions. With the new Require cloud credentials setting, owners can ensure that no one in the workspace can view sensitive passwords or use them during local training or execution. The policy is enforced by mabl's API rather than only in the create form, so it covers credentials created through the web app, the mabl CLI, and the public API alike.
Cloud credentials cannot be used in the mabl Trainer or local runs
When Require cloud credentials is on, users must enter credentials manually while training and author their tests in the cloud instead. For the full set of options, see Working with credentials.
How it works
The policy is off by default, and only workspace owners can change it.
- Go to Settings > Workspace.
- Under Cloud credentials, turn on Require cloud credentials.
With the policy on, the Save as cloud credential checkbox is checked and locked for every new credential in that workspace, along with a line explaining why:
Database credentials follow the same rule. A credential created through the mabl API or CLI without asking for a cloud credential is rejected with an error naming the policy, so automation that creates credentials fails loudly instead of quietly storing a readable password.
What the policy doesn't change
- Existing credentials stay as they are. Credentials that predate the policy remain readable, remain editable as normal credentials, and remain usable in the Trainer and in local runs. The policy governs creation only, and it never converts anything for you.
- No one is exempt. The policy applies to every caller in the workspace, workspace owners and API keys included.
- Converting a credential to cloud is still one way. Once a credential becomes a cloud credential, it can't be turned back into a normal one.