Every credential is bound to one organization, an explicit scope set, an API date, and optionally one workspace and an IP allowlist.
Create keys in Developers and store them in a secret manager. Ceyu never accepts a key in a URL or browser bundle. Revocation through Ceyu takes effect locally before the provider call completes.
Authorization: Bearer $CEYU_API_KEY
Ceyu-Version: 2026-08-03WorkOS Connect applications exchange client credentials for a short-lived JWT. Ceyu verifies its signature, issuer, audience, organization and scopes locally against cached JWKS.
Grant only the scopes the integration uses. Add an IP allowlist for fixed servers and a workspace restriction for single-project integrations. A foreign or hidden resource always returns 404, never a revealing 403.
Test credentials must point at the separate test organization configured for the customer. Never use a live credential for fixtures, demonstrations or CI.