An integration should not stop because the developer who created it leaves or a personal account is closed. Credentials are part of the operating model, not a detail to collect at the end. Decide who owns access and how it changes before connecting production systems.
Related service: Custom software development- 01Identify the account and business owner.
- 02Grant only required permissions.
- 03Store and reference the secret safely.
- 04Test a replacement credential.
- 05Revoke obsolete access and confirm operation.
SECTION 01
Separate ownership from day-to-day developer access
List the service account or application, its business owner, environment, allowed actions and renewal requirements. Development and production should not casually share the same broad credential. If a provider requires a person to authorize a connection, document the consequences when that person's membership or permissions change.
OWASP's secrets guidance covers creation, storage, rotation, revocation and expiry. Its authorization guidance supports limited, checked access. Ask the agency how the runtime receives a secret and which people can retrieve or replace it. A configuration screenshot with the key blurred is not a complete handoff; the organization needs a repeatable way to manage the connection.
SECTION 02
Illustrative example: replacing an order-sync credential
Imagine an order-sync integration uses a credential created during development. Before handoff, the business creates the appropriate production-owned access. Where the provider permits overlapping credentials, the agency installs the replacement, tests a read and a controlled write, and observes the next scheduled synchronization before revoking the old credential.
If overlap is not supported, the team plans a brief change window and queues pending work. The hypothetical test includes a deliberate old-credential failure after revocation and confirmation that the worker uses the replacement. Nobody pastes the new secret into a shared issue or includes it in exported logs to prove the change happened.
SECTION 03
Require a usable rotation record
For a modest integration, a credential inventory and a short tested runbook may be sufficient. A managed secret store can simplify controlled access, but choosing a product does not establish ownership or an incident process. Do not add an elaborate platform solely to manage two well-understood connections.
Acceptance should cover an expired credential, a revoked permission, a wrong-environment secret and replacement during queued work. Confirm that failures produce useful alerts without leaking secrets. Record the credential reference, owner, dependencies, test procedure and recovery option, not the secret itself. If compromise is suspected, follow the organization's incident process; maintaining uninterrupted service is not a reason to keep known-compromised access active.
SECTION 04
Frequently asked questions
Should the agency keep ownership of production accounts?
The business should retain appropriate ownership and recovery control. Agency access can be delegated for agreed work and removed or changed without losing the service.
Can the handoff include API keys in a spreadsheet?
Avoid routine secret distribution in handoff files. Document secure references and access procedures instead, using an approved secrets-management method.
Can rotation happen without downtime?
Sometimes, if the provider supports overlap and the integration can reload credentials safely. Confirm that behavior; otherwise plan a controlled interruption and recovery.
PRIMARY REFERENCES
Sources and further reading
These references cover the standards, platforms, or published prices discussed in the guide. Worked examples and checklists are our editorial guidance.
- Secrets management lifecycleOWASP Foundation
- Authorization guidanceOWASP Foundation
EDITORIAL METHOD
About this guide
We use AI to assist with drafting and editing. Catapult AI Work is responsible for the published content. Examples illustrate possible approaches; they are not client case studies unless identified as such.
Budget examples are not Catapult package prices. Check linked provider pages for current fees and plan limits before making a purchase.
Read the editorial policy