Issue and manage embed credentials

Last updated: August 16, 2026

An embed credential is a long-lived secret your backend holds and exchanges for short-lived embed sessions. It's one of the four things a widget needs before it serves — see embed a Nash widget on your site for the whole sequence. You manage credentials in the Embed credentials section of the Widgets settings page.

Find it under Settings ▸ Connections ▸ Widgets, in the Embed credentials section.

Note

You'll need organization-management permissions to change these settings.

How credentials work

The secret is long-lived and lives on your server. Your backend exchanges it for an embed session, which is short-lived — 15 minutes at most — and that session is what the browser receives. The browser only ever sees the session, never the long-lived secret. Keep the secret in your backend or a secret manager, never in page code.

Important

Credential actions commit immediately — they are not held behind the Save changes bar that the catalog and origins use. Issuing, rotating, revoking, or renaming a credential takes effect the moment you confirm the dialog.

Embed credentials are not the same as your API keys or webhooks, which live under Settings > Connections, alongside Widgets. A credential here is specifically the secret your backend swaps for an embed session.

Issue a credential

Select Issue credential, give it a name (name it after where it will live, so you can tell credentials apart later), then copy the one-time secret.

Warning

The secret is shown once. Nash stores only a hash and genuinely cannot show it again. Copy it into your backend or secret manager before you close the dialog — the dialog stays locked until you've copied it.

Rotate a credential

Rotating replaces the secret. On an Active credential, open the row's actions menu (⋯) and choose Rotate. Pick how the old secret winds down:

  • Wind down the old secret — recommended. The current secret keeps working for 60 minutes while you deploy the new one. Use this for a normal rotation so nothing breaks mid-deploy.
  • Retire it immediately. The current secret stops working the moment you rotate. Use this if you think the secret leaked.

Then copy the new secret — shown once, same as issuing. A credential that's winding down shows a Retiring · until {time} status until the old secret expires.

Revoke a credential

Revoking stops a credential immediately. Open the row's actions menu (⋯) on an Active credential and choose Revoke.

Warning

Revoke stops the credential working right away. There is no wind-down and no undo. Anything still using it will start failing at once — if the credential is in active use, rotate with a wind-down instead.

Rename a credential

Renaming is cosmetic — the secret and its status don't change. Open the actions menu (⋯) and choose Rename.

Credential statuses

Status What it means
Active Working now. This is the only status with row actions (rotate, rename, revoke).
Retiring An active credential in a wind-down after a rotation — it works until the shown expiry, then stops.
Expired A wound-down secret whose window has passed. Terminal — no actions.
Revoked Stopped immediately, no undo. Terminal — no actions. Hidden by default behind Show revoked.

The table also shows each credential's last-four digits, when it was last used (Never used if it hasn't minted a session yet), and its lifecycle dates. Only Active credentials have an actions menu; expired and revoked ones are terminal.

Related