Set up credential exchange

Credential exchange gives an Embedded workflow access to your app for a specific end user. The customer connects third-party apps in the SDK modal. When the workflow needs your app's credentials, MindCloud calls an endpoint that your backend owns.

1. Open Embedded → Credential Exchange in the MindCloud dashboard.

2. Enter the HTTPS Exchange Endpoint on your backend.

3. Return the fields required by your embedded app's authentication type. Use the response example shown on the dashboard page.

4. Use Test Exchange with safe sample values before running a workflow.

MindCloud sends a POST request with integrationId, installationId, externalId, and endUserId. The externalId is the identifier you supplied when you created the end user. Resolve that identity on your backend and return credentials only for the requested customer. Treat the response as a secret.

{
  "integrationId": "int_...",
  "installationId": "install_...",
  "externalId": "customer-123",
  "endUserId": "enduser_..."
}

For request verification, enable Signing Signature and set a shared secret. MindCloud sends X-Timestamp and X-Signature. The signature is a hex HMAC-SHA256 over timestamp + "\nPOST\n" + fullRequestUrl, using that secret. Verify the timestamp and compare signatures in constant time. The full request URL includes the appended endUserId query parameter.

If the exchange URL contains per-user host variables, send their validated values as metadata in Create an end user. This endpoint is for workflow access to your app; connect-only API integrations do not use credential exchange.