--- sourceDocument: Australia Workflow Data Fabric sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications Release : - australia ft:locale : - en-US ft:publication_title : - Australia Workflow Data Fabric ft:clusterId : - crint bundleId : - crint workflow : - Creator --- # External credential vault # External credential vault in RPA Hub {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of External credential vault in RPA Hub The external credential vault feature in RPA Hub enables secure retrieval of sensitive credentials---such as robot credentials, application credentials, or Time-based One-time Password (TOTP) seeds---during automation execution. This integration enhances security by optionally fetching credentials from an external vault rather than storing them directly in the ServiceNow instance. Show full answer Show less ## How External Credential Vault Integration Works * A robot operating within the customer environment requests sensitive data via a GraphQL API call to RPA Hub when needed for automation tasks (e.g., logging into SAP). * Depending on whether the External Credential checkbox is selected on the robot credential, application credential, or TOTP authenticator forms: * If unchecked, credentials are saved and retrieved locally within the ServiceNow instance. * If checked, credentials or TOTP seeds are fetched from a configured external credential vault such as CyberArk or Azure Key Vault. * When external credential retrieval is enabled, the API triggers a subflow that makes a REST API call to the external vault. This call can be routed either directly or via a MID Server residing in the customer environment, based on organizational setup. * After retrieval, the credentials are securely sent back to the robot for use in automation. ## Key Configuration and Security Considerations * It is critical to configure external credential settings properly to ensure that sensitive data is not stored or logged within the ServiceNow instance. * The Reporting field for the subflow interacting with the external vault must be set to **Off** to prevent capturing or logging of sensitive information. * Outbound request logging can be enabled to monitor and debug third-party service interactions, including calls to external credential vaults. * Guidance and steps for configuring credentials and external vault integration are provided within RPA Hub documentation. ## Benefits for ServiceNow Customers * Enhances security by leveraging external vaults to store and manage sensitive credentials. * Provides flexibility to integrate with various external vault solutions according to organizational policies. * Supports secure automation workflows by ensuring credentials are fetched dynamically and not exposed in the ServiceNow instance. * Enables detailed logging and monitoring of outbound API requests to support compliance and troubleshooting. With the external credential vault feature, you can retrieve robot credentials, application credentials, or Time-based One-time Password (TOTP) seed. ## External credential vault integration with RPA Hub {#external-credentials-rpa__section_k4r_jgs_5zb} The following diagram shows the integration of an external credential vault with RPA Hub. A robot resides in the customers' environment. If the robot requires sensitive data during the automation execution, then the robot makes a GraphQL Application Programming Interface (API) call to the RPA Hub. An example of the sensitive data is user name and password details while logging in to an SAP application. Based on the input provided in the External Credential check box, either on a robot credential form, an application credential form, or a TOTP authenticator form: * If the input is false (if the check box isn't selected), the credentials are saved or retrieved from the instance. * If the input is true (if the check box is selected in the robot credential form, an application credential form), the credentials are fetched from a configured external credential vault. If the check box is selected in the TOTP authenticator form, the seed is fetched from a configured external credential vault. {#external-credentials-rpa__ul_mxb_wzv_wzb}For more information about configuring these fields, see [Create a robot credential in RPA Hub](https://www.servicenow.com/docs/9lqAtoqlQiJfR0sZBW3M8w "Create a robot credential so that the unattended robot can log in to a Windows machine and perform the automation."), [Create an application credential in RPA Hub](https://www.servicenow.com/docs/3FdZA1xy5oftorozt051Lw "Create an application credential to add the application user name and password. An unattended robot can use this application credential to log in to an application when the automation is executed."), and [Create a TOTP authenticator in RPA Hub](https://www.servicenow.com/docs/FTfyLWmXY4aJ7jUYYKBt5g "Map a multi-factor authentication (MFA) authenticator record with a seed in a robot credential. This mapping results in creating a Time-based One-time Password (TOTP) authenticator record in RPA Hub."). Examples of an external credential vault are CyberArk, Azure key Vault, and so on. If the External Credential check box isn't enabled, the API returns the data stored in the Password2 field of the ServiceNow instance and then the robot uses the sensitive data for the automation execution. If the External Credential check box is enabled, the credentials are fetched from a configured external credential vault. In this scenario, the API internally triggers a subflow. This subflow makes a REST API call to the external credential vault. You can route this REST API call via MID Server. Or, you can directly establish a connection with the external credential vault. This implementation is dependent on your organizational requirements. The MID Server resides in the customers' environment. For more information about MID Server, see [MID Server](https://www.servicenow.com/docs/access?context=mid-server-landing&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). After the REST API call fetches the credential from the vault, the credentials are sent to the robot. Figure 1. Integration of external credential vault with RPA Hub ## Important information {#external-credentials-rpa__section_jzg_nyh_vzb} You must configure the external credential settings appropriately, so that the data isn't stored or logged in the ServiceNow instance. Verify that the value of the Reporting field is set to Off for the subflow of your external credential vault, for example Demo CyberArk Subflow. This setting verifies that the sensitive data isn't captured or logged. For more information about configuring this setting, see . To configure the external credential vault in RPA Hub, see [Steps to configure an external credential vault in RPA Hub](https://www.servicenow.com/docs/BSFIDEG8V7pEAH3sdu8rEA "Use this list of steps to guide you through all the tasks of configuring an external credential vault in RPA Hub."). Outbound request logging enables you to understand what third party services your instance accesses and the volume of outbound requests. Additionally, logging can provide valuable information when debugging outbound integrations. For more information about system logging or outbound logging, see and .