Credential Sync

Credential sync eliminates the manual step between rotating a credential in VeraID and updating it in the systems that consume it. When a credential is rotated, VeraID automatically pushes the new value to one or more configured sync targets — secret managers, CI/CD platforms, and orchestration systems — so your services pick up the new credential without human intervention.

Supported Sync Targets

VeraID supports six sync targets out of the box, covering the most common secret storage and CI/CD platforms.

Target	Identifier	Description
AWS Secrets Manager	AWS_SECRETS_MANAGER	Syncs credentials to AWS Secrets Manager as secret values
Kubernetes Secrets	KUBERNETES_SECRET	Updates Kubernetes Secret resources in specified namespaces
GitHub Actions Secrets	GITHUB_ACTIONS	Pushes credentials to GitHub repository or organization secrets
GitLab CI Variables	GITLAB_CI	Updates GitLab CI/CD variables at project or group level
CircleCI Contexts	CIRCLECI_CONTEXT	Syncs credentials to CircleCI context environment variables
Jenkins Credentials	JENKINS	Updates Jenkins credential store entries

Tip

Sync targets can be combined. A single credential can sync to AWS Secrets Manager for your runtime services, GitHub Actions for your CI/CD pipelines, and Kubernetes Secrets for your cluster workloads — all in a single rotation event.

How Sync Works

Credential sync executes as part of the rotation lifecycle, immediately after a new credential is issued.

Rotation triggered
       │
       ▼
New credential issued
       │
       ▼
Sync to Target 1 ──► Success ✓
       │
       ▼
Sync to Target 2 ──► Success ✓
       │
       ▼
Sync to Target 3 ──► Failure ✗ ──► Retry (up to 3 attempts)
       │                                    │
       │                              Still failing?
       │                                    │
       │                                    ▼
       │                              Rollback all targets
       │                              Revert to old credential
       │                              Alert operators
       ▼
All targets synced ──► Grace period begins

Sync Order

1. Sequential execution — Targets are synced in the order they are defined in the rotation schedule. Each target must succeed before the next one begins.
2. Retry logic — If a sync operation fails, VeraID retries up to 3 times with exponential backoff (1s, 5s, 15s).
3. Rollback on failure — If all retry attempts fail for any target, VeraID rolls back all previously synced targets to the old credential value and reverts the rotation. The old credential remains active, and operators are alerted.

Caution

Rollback restores the previous credential value in all external targets that were successfully synced before the failure. The new credential is revoked, and the rotation is marked as failed in the audit log. A failed sync does not leave your systems in an inconsistent state.

Configuring Sync Targets

Sync targets are configured as part of a rotation schedule or directly on a credential’s rotation policy.

AWS Secrets Manager

{
  "type": "AWS_SECRETS_MANAGER",
  "config": {
    "region": "us-east-1",
    "secretName": "/production/payment-service/api-key",
    "roleArn": "arn:aws:iam::123456789012:role/veraid-sync-role",
    "versionStage": "AWSCURRENT"
  }
}

Field	Required	Description
region	Yes	AWS region where the secret is stored
secretName	Yes	Full secret name or ARN
roleArn	Yes	IAM role ARN that VeraID assumes for cross-account access
versionStage	No	Version stage label (defaults to AWSCURRENT)

Kubernetes Secrets

{
  "type": "KUBERNETES_SECRET",
  "config": {
    "clusterName": "production-us-east",
    "namespace": "payments",
    "secretName": "api-credentials",
    "key": "PAYMENT_API_KEY",
    "kubeConfigSecret": "veraid-kubeconfig-prod"
  }
}

Field	Required	Description
clusterName	Yes	Identifier for the target Kubernetes cluster
namespace	Yes	Kubernetes namespace containing the Secret
secretName	Yes	Name of the Kubernetes Secret resource
key	Yes	Key within the Secret’s data map to update
kubeConfigSecret	Yes	Reference to the stored kubeconfig for cluster access

GitHub Actions Secrets

{
  "type": "GITHUB_ACTIONS",
  "config": {
    "owner": "acme-corp",
    "repository": "web-app",
    "secretName": "VERAID_API_KEY",
    "scope": "repository"
  }
}

Field	Required	Description
owner	Yes	GitHub organization or user
repository	Conditional	Repository name (required when scope is repository)
secretName	Yes	Name of the GitHub Actions secret
scope	Yes	repository or organization

GitLab CI Variables

{
  "type": "GITLAB_CI",
  "config": {
    "projectId": 12345678,
    "key": "VERAID_API_KEY",
    "environmentScope": "production",
    "masked": true,
    "protected": true
  }
}

Field	Required	Description
projectId	Yes	GitLab project ID (numeric)
key	Yes	CI/CD variable key name
environmentScope	No	Environment scope (defaults to * for all environments)
masked	No	Whether the variable is masked in job logs (defaults to true)
protected	No	Whether the variable is only available in protected branches (defaults to true)

CircleCI Contexts

{
  "type": "CIRCLECI_CONTEXT",
  "config": {
    "organizationId": "org-uuid-here",
    "contextName": "production-secrets",
    "variableName": "VERAID_API_KEY"
  }
}

Field	Required	Description
organizationId	Yes	CircleCI organization UUID
contextName	Yes	Name of the CircleCI context
variableName	Yes	Environment variable name within the context

Jenkins Credentials

{
  "type": "JENKINS",
  "config": {
    "baseUrl": "https://jenkins.internal.acme.com",
    "credentialId": "veraid-api-key",
    "domain": "_",
    "scope": "GLOBAL"
  }
}

Field	Required	Description
baseUrl	Yes	Jenkins server URL
credentialId	Yes	ID of the credential entry in Jenkins
domain	No	Jenkins credential domain (defaults to _ for global)
scope	No	GLOBAL or SYSTEM (defaults to GLOBAL)

Multi-Target Sync Example

A complete rotation schedule with multiple sync targets:

curl -X POST https://app.veraid.io/api/v1/rotation-schedules \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "payment-service-rotation",
    "intervalDays": 30,
    "gracePeriodHours": 12,
    "notifyDaysBefore": 5,
    "notifyChannels": ["email", "webhook"],
    "syncTargets": [
      {
        "type": "AWS_SECRETS_MANAGER",
        "config": {
          "region": "us-east-1",
          "secretName": "/prod/payment-service/api-key",
          "roleArn": "arn:aws:iam::123456789012:role/veraid-sync"
        }
      },
      {
        "type": "KUBERNETES_SECRET",
        "config": {
          "clusterName": "production-us-east",
          "namespace": "payments",
          "secretName": "api-credentials",
          "key": "PAYMENT_API_KEY",
          "kubeConfigSecret": "veraid-kubeconfig-prod"
        }
      },
      {
        "type": "GITHUB_ACTIONS",
        "config": {
          "owner": "acme-corp",
          "repository": "payment-service",
          "secretName": "VERAID_API_KEY",
          "scope": "repository"
        }
      }
    ]
  }'

Sync Authentication

Each sync target requires VeraID to authenticate with the external platform. Credentials for sync target access are stored securely in VeraID and are separate from the credentials being rotated.

Target	Authentication Method
AWS Secrets Manager	IAM role assumption via STS (cross-account)
Kubernetes Secrets	Kubeconfig with service account token
GitHub Actions	GitHub App installation token or personal access token
GitLab CI	Project or group access token
CircleCI	CircleCI API token
Jenkins	Jenkins API token with credentials permission

Note

Sync target authentication credentials are configured during initial setup and stored encrypted in VeraID. They are never exposed in API responses or audit logs.

Monitoring Sync Status

Sync Events in Audit Log

Every sync operation is recorded in the audit log with target-level detail:

curl -X GET "https://app.veraid.io/api/v1/audit?action=credential.synced&limit=10" \
  -H "Authorization: Bearer kd_live_your_api_key"

{
  "data": [
    {
      "id": "aud_sync_event_id",
      "action": "credential.synced",
      "credentialId": "crd_9f24d67e-a1b3-4c5d-8e7f-2a3b4c5d6e7f",
      "syncResults": [
        { "target": "AWS_SECRETS_MANAGER", "status": "success", "duration": 342 },
        { "target": "KUBERNETES_SECRET", "status": "success", "duration": 1205 },
        { "target": "GITHUB_ACTIONS", "status": "success", "duration": 876 }
      ],
      "timestamp": "2026-03-19T10:00:05Z"
    }
  ]
}

Failed Sync Alerts

When a sync operation fails after all retries, VeraID sends alerts through the rotation schedule’s configured notification channels. The alert includes:

• Which target failed and the error message
• Whether rollback was triggered
• The current state of the credential (old credential restored or new credential active)
• Recommended remediation steps

What’s Next

• Credential Verification — Validate credentials at runtime via the verification API
• Credential Rotation — Configure rotation policies and schedules
• Identity Groups — Apply sync configurations to groups of identities