Integrations

Static credentials (API keys, client secrets, passwords) and OAuth tokens (access + refresh) are stored across four vaults, split by who reads them (see "Four vaults, four Connect tokens" below). OAuth refresh is owned by apps/wsp/oauth-refresher (a trigger.dev task on a /15 cron) which rotates and writes the new access/refresh tokens back to the vault via setCred/setRawField; integrations read the current accesstoken from 1P at use time via getRawField(CREDS.x, "accesstoken", { ttlMs: 0 }). The legacy on-disk tokens/ subdirectories were retired 2026-05-07 — no integration stores OAuth tokens on disk.