Partner API credentials

Partner API credentials, out of your code.

A partner’s API key sits in an environment variable, a config file and at least one old commit. Save it once in EchoRelay instead: sealed on save, bound to the host it may reach, and applied only when a delivery goes to that host.

Worked example

Call a translation service without carrying its token in your app

Your app authenticates to EchoRelay with its own caller API key. EchoRelay uses a stored partner token when delivering to your translation service. This example uses a fictional API; the token below is a placeholder.

Your caller sends this body with its EchoRelay API key

{
  "text": "Hello",
  "targetLanguage": "pl"
}

Illustrative request to your translation service

POST /translate HTTP/1.1
Host: translator.example.com
Authorization: Bearer <stored partner token>
Content-Type: application/json

{
  "text": "Hello",
  "targetLanguage": "pl"
}
  1. Store a bearer credential and bind it to translator.example.com.
  2. Reference that stored credential on a synchronous target at https://translator.example.com/translate.
  3. Publish the endpoint. Your app sends the translation request with its EchoRelay API key.

The partner token is added to the outbound Authorization header at delivery. Its destination binding restricts which host can receive it, and stored credentials require HTTPS delivery. Your app still needs to protect its EchoRelay API key.

Why EchoRelay

Less to build, less to run.

Saved once, referenced everywhere

Every target that calls the partner points at the one saved credential. Replace the key once and each of them picks up the new value automatically.

Bound to its host

A credential is tied, when you save it, to the host it may be sent to (an exact host, or a one-label wildcard like *.example.com), so it is never sent to any other host, by configuration or by mistake.

Sealed, not just hidden

The value is sealed with encryption specific to your project. The dashboard that saves it cannot read it back, and it is never shown again, only replaced.

Questions

Answered, honestly.

Which kinds of credentials can I store?
Bearer tokens, basic auth, an API key in a header or a query parameter, and a public/private key pair. Client certificates (mTLS) aren’t supported yet.
Can I see a stored credential again?
No. You can rename it or replace its value, but nobody reads it back from the dashboard, including you.
What happens to targets when I rotate a key?
You replace the value once, and every target that references it picks up the new one automatically. No target needs editing.

Connect everything. Deploy nothing.

Build an integration Credential vault docs

No credit card required.