Create a machine credential

Machine credentials let a script, notebook, or integration call enabled Signal APIs on your behalf. Most users do not need one.

Before you create one#

Confirm that the integration cannot use an existing supported connection. A machine credential belongs to you and the current workspace, so its activity should have a clear owner.

Choose the narrowest access the job needs. A reporting script that only reads Task results should not receive write or administration permission.

Create the credential#

1. Open Profile, then Machine credentials.
2. Enter a name that identifies the system and purpose.
3. Choose the lowest suitable role ceiling.
4. Select only the required scopes.
5. Create the credential.
6. Copy the client ID, secret, and token audience immediately.

The secret is shown only once. Store it in an approved secret manager; do not paste it into source code, a document, Chat, or a Task.

Use and rotate it safely#

The page provides examples for requesting a token and calling the API. Adapt them without exposing the secret in command history or logs.

Review credentials regularly. Revoke one immediately when:

• The integration is retired.
• Its owner changes.
• A device or repository containing the secret may be compromised.
• The credential has more access than the job needs.

Create a replacement before revoking when a production integration needs uninterrupted access, then confirm the new credential works and remove the old one.

If machine credentials are unavailable in your environment, contact your workspace administrator or Signal contact.