Viewing & replacing your credentials

Keys don't last forever — they expire, get rotated, or occasionally need to be checked. The Deployer lets you view what's stored and replace it in place, without deleting the connection or touching the projects that rely on it. Both actions are protected by an extra password check, so only someone who knows your account password can use them.

The two actions on every connection card

On the Connections page, each cloud and GitHub card has a row of small icons:

• Eye icon — "View credentials" (for GitHub, "View token"). Reveals the stored key so you can confirm what's saved.
• Key / refresh icon — "Replace credentials" (for GitHub, "Replace token"). Swaps in a new key while keeping the same connection.
• Trash icon — "Delete connection". Removes it entirely (use this only if you no longer need it).

Normally the card shows just a masked hint — the last few characters, like ••••7F3a — which is enough to tell two accounts apart without exposing anything.

Both viewing and replacing require your account password

Before The Deployer will reveal or replace a stored key, it asks you to re-enter your account password (the one you sign in with). This is a deliberate security step-up: even if you've left yourself logged in, no one can peek at or swap your keys without knowing your password. If you type the wrong password a few times in a row, the action is briefly locked to prevent guessing — just wait a minute and try again.

Viewing a credential

Click the eye icon, enter your account password, and The Deployer displays the full stored value(s) for that connection. The reveal is read-only: nothing new is saved and the value isn't cached in the page. Each reveal is recorded in an internal audit log; there is no audit view in the app yet.

Treat a revealed credential as exposed on that screen. If you need the key somewhere else, it's safer to create a new key at the provider for that purpose than to copy a stored one out of The Deployer.

Planned change: we plan to make stored credentials write-only. After that, a card will show the masked hint and let you replace or revoke the credential, but not reveal it.

Replacing a credential

Click the replace icon (the key icon on cloud cards, the refresh icon on GitHub cards), enter your account password, then paste the new key. The Deployer handles the swap carefully:

1. It verifies the new key first — signing in with it to confirm it actually works.
2. Only if the new key passes does it overwrite the old one.
3. If the new key fails, it's rejected with an error and your old key is kept untouched — so your connection, and every project using it, keeps working. You can fix the new key and try again with no harm done.

This "verify-before-replace" approach means a typo or a wrong key doesn't replace a working one. Because the connection keeps its identity, you don't have to reconnect it to your projects.

Package repository tokens

Cards in the Package repositories section of the Connections page work the same way, with a few differences:

• Only the workspace owner sees the view, replace and delete actions.
• The token is write-only. Once saved, it's never sent back to the page; the card shows a masked hint and, where your repository reports it, when the token expires. View token still needs your account password.
• Replacing is checked first. Enter your account password and the new token (or username and password). The Deployer signs in to your repository with it, and only replaces the old one if that works. If the repository refuses it, you'll see "The repository refused the new token. Your current one is still in place."
• Connections that use your cloud account have nothing to replace. For AWS CodeArtifact, Google Artifact Registry or Azure Artifacts connected through your cloud account, no token is stored; each build gets a short-lived one.

Package repository tokens are never shown to AI models and are never written into your app's image. See Package repositories.

When would I replace a key?

• It expired. GitHub tokens and Azure client secrets can be set to expire; AWS and DigitalOcean keys can be rotated on a schedule. When one lapses, deploys that need it start failing — replace it to get going again.
• You rotated it for hygiene. Periodically retiring old keys and issuing fresh ones is good practice (see permissions & security).
• It may have leaked. If a key was exposed, delete it at the provider first (that instantly disables the old one), create a new key, and replace it here.
• The app noticed for you. If a deployment fails because a key is invalid or expired, The Deployer often spots it and offers a one-click Replace credential prompt right there — the same secure flow described above. For a package repository that rejects its token the button reads Replace token.

Whatever the reason, replacing keeps you on the same connection, so there's nothing else to reconnect afterward.