Configuration fields for all service types available in Services Administration. Some types also support optional Mutual TLS and SOAP Digital Signature settings.
Authentication services support two modes: Standard uses a named authentication method, and Custom uses a configured authenticator.
Authentication (Standard)
Note: OAuth2 JWT Bearer Grant, OAuth2 JWT Client Credential Grant Extended, and OAuth2 Password Grant call the token endpoint for a new token every time the service is called. To cache tokens between calls, use OAuth2 Client Credentials Grant with Enable Token Persistence enabled.
Amazon S3
| Field | Description |
|---|---|
| Access key ID | The AWS access key ID. |
| Secret Access Key | The AWS secret access key. |
| Region | The AWS region where the S3 bucket is located. |
Azure Blob Storage
| Field | Description |
|---|---|
| Connection String | The Azure Blob Storage connection string. |
Basic Auth
| Field | Description |
|---|---|
| Username | The username for basic authentication. |
| Password | The password for basic authentication. |
Supports Mutual TLS.
Bearer Token
| Field | Description |
|---|---|
| Bearer Token | The bearer token to include in the Authorization header. |
Supports Mutual TLS.
Canada Post
| Field | Description |
|---|---|
| API Key | The Canada POST API key. |
Custom SOAP Header
| Field | Description |
|---|---|
| SOAP Header | The custom SOAP header value. |
Supports SOAP Digital Signature and Mutual TLS.
Google Places
| Field | Description |
|---|---|
| API Key | The Google Places API key. |
HMAC
HMAC (Hash-based Message Authentication Code) uses a cryptographic hash function and a shared secret key to verify both the integrity and authenticity of a request. It is commonly used to authenticate API requests by signing them with a key that only the sender and receiver know. See HMAC Concepts for more detail.
Note: This service type requires server-side execution. Direct browser or external calls will fail.
| Field | Description |
|---|---|
| HMAC Private Key (Armored) | The HMAC private key in armored format. |
Hyperscience
| Field | Description |
|---|---|
| API Key | The Hyperscience API key. |
Supports Mutual TLS.
No Authentication
No configuration fields required. Supports SOAP Digital Signature and Mutual TLS.
OAuth2 Client Credentials Grant
| Field | Required | Description |
|---|---|---|
| Access Token URL | Yes | The URL used to obtain an access token. |
| Client ID | Yes | The OAuth2 client identifier. |
| Client Secret | Yes | The OAuth2 client secret. |
| Scope | No | The OAuth2 scope(s) to request. |
| Send Client ID/Secret in Body instead of Header | — | When checked, this setting sends credentials in the request body instead of the Authorization header. |
| Perform Authentication Only | — | When checked, this setting returns the access token immediately in the service response without making a downstream request. |
| Enable Token Persistence | — | When checked, this setting caches the access token until it expires, reducing calls to the token endpoint. When the token expires, Unqork retrieves a new one automatically. |
Note: OAuth2 Client Credentials Grant is the only OAuth2 type that supports Enable Token Persistence.
Supports Mutual TLS.
OAuth2 JWT Bearer Grant
Note: This grant type calls the token endpoint for a new token each time the service is called. Token persistence is not supported.
| Field | Required | Description |
|---|---|---|
| Access Token URL | Yes | The URL used to obtain an access token. |
| Issuer | Yes | The issuer claim, typically the Client ID. |
| Subject | Yes | The user or entity the token is issued for. |
| Audience | Yes | The host or resource the token is intended for. |
| Scope(s) to Access | Yes | Space-separated list of scopes to request. |
| Token Expires In (Seconds) | No | How long the token is valid. Defaults to 60 minutes. |
| Signing Algorithm | Yes | The JWT signing algorithm (for example, RS256, HS256). |
| Shared/Private Key | Yes | The key used to sign the JWT. |
| Perform Authentication Only | — | When checked, this setting returns the access token immediately in the service response without making a downstream request. |
Supports Mutual TLS.
OAuth2 JWT Client Credential Grant Extended
Note: This grant type calls the token endpoint for a new token each time the service is called. Token persistence is not supported.
| Field | Description |
|---|---|
| Access Token URL | The URL used to obtain an access token. |
| Client ID | The OAuth2 client identifier. |
| Module ID | The resource identifier. |
| Secret Key for User Authorization JWT Signing | The secret key used to sign user authorization JWTs. |
| Encryption Key for User Authorization Header | The key used to encrypt the user authorization header. |
| Certificate pem | The certificate in PEM format. |
| Private Key Pem | The private key in PEM format. |
OAuth2 Password Grant
Note: This grant type calls the token endpoint for a new token each time the service is called. Token persistence is not supported.
| Field | Required | Description |
|---|---|---|
| Access Token URL | Yes | The URL used to obtain an access token. |
| Client ID | Yes | The OAuth2 client identifier. |
| Client Secret | Yes | The OAuth2 client secret. |
| Scope | No | The OAuth2 scope(s) to request. |
| Username | Yes | The resource owner's username. |
| Password | Yes | The resource owner's password. |
| Send Client ID/Secret in Body instead of Header | — | When checked, this setting sends credentials in the request body instead of the Authorization header. |
| Send Authentication Body as application/json | — | When checked, this setting sends the authentication body as JSON instead of application/x-www-form-urlencoded. Uncommon. |
| Perform Authentication Only | — | When checked, this setting returns the access token immediately in the service response without making a downstream request. |
Supports Mutual TLS.
OpenID Connect (OIDC)
No standard configuration fields. OIDC service configuration is handled through the authentication flow.
Supports Mutual TLS.
Plaid
| Field | Description |
|---|---|
| Client ID | The Plaid client identifier. |
| Public Key | The Plaid public key. |
| Client Secret | The Plaid client secret. |
| Environment | The Plaid environment to connect to. Options include: Sandbox, Development, or Production. |
Twilio
| Field | Description |
|---|---|
| Account SID | The Twilio account SID. |
| Auth Token | The Twilio authentication token. |
| Number | The Twilio phone number. |
| Express Domain | The Express domain associated with the Twilio account. |
WSSE Username Token Profile
| Field | Description |
|---|---|
| Username | The username for WSSE authentication. |
| Password | The password for WSSE authentication. |
Supports SOAP Digital Signature and Mutual TLS.
Authentication (Custom)
Custom Authentication uses a configured authenticator. Select an authenticator from the drop-down; the configuration fields are determined by the selected authenticator. See the authenticator's documentation for field details.
FTP
FTP
Important: FTP is an insecure protocol that transmits credentials in plain text. Use SFTP instead whenever possible.
| Field | Required | Description |
|---|---|---|
| Host | Yes | The FTP server host address. |
| Port | No | The FTP server port. Defaults to 21. |
| Username | No | The FTP username. |
| Password | No | The FTP password. |
SFTP
| Field | Required | Description |
|---|---|---|
| Host | Yes | The SFTP server host address. |
| Username | Yes | The SFTP username. |
| Password | No | The SFTP password. |
| SSH Private Key (.pem) | No | The SSH private key in PEM format. |
| Private Key Passphrase | No | The passphrase for the SSH private key. |
Considerations
SFTP services configured in Services Administration only support specific private key formats.
Supported
- PKCS#1 encrypted (
-----BEGIN RSA PRIVATE KEY-----withProc-Type: 4,ENCRYPTED) - PKCS#1 unencrypted (
-----BEGIN RSA PRIVATE KEY-----) - OpenSSH encrypted (
-----BEGIN OPENSSH PRIVATE KEY-----) - OpenSSH unencrypted (
-----BEGIN OPENSSH PRIVATE KEY-----)
Unsupported
- PKCS#8 encrypted (
-----BEGIN ENCRYPTED PRIVATE KEY-----) - PKCS#8 unencrypted (
-----BEGIN PRIVATE KEY-----)
Encryption
Encryption (GPG)
Note: This service type requires server-side execution. Direct browser or external calls will fail.
| Field | Description |
|---|---|
| GPG Public Key (Armored) | The GPG public key used for encryption, in armored format. |
Decryption (GPG)
Note: This service type requires server-side execution. Direct browser or external calls will fail.
| Field | Description |
|---|---|
| GPG Private Key (Armored) | The GPG private key used for decryption, in armored format. |
Mutual TLS
Mutual TLS (mTLS) extends standard TLS by requiring both the client and server to authenticate with certificates. Where standard TLS only verifies the server's identity, mTLS verifies both parties, making it appropriate for service-to-service communication where strict authentication is required. Mutual TLS is available on most Standard Authentication types. See Mutual TLS Concepts for more detail.
| Setting | Description |
|---|---|
| Enable Mutual TLS | When checked, this setting enables mutual TLS for the service. |
| Certificates | The certificate to use for mutual TLS authentication. Displays when Enable Mutual TLS is checked. Manage certificates in Certificate Management. |
| Do Not Follow Redirect | When checked, this setting prevents the service from following HTTP redirects. |
SOAP Digital Signature
SOAP Digital Signature adds a cryptographic signature to outbound SOAP requests, verifying that the request content has not been altered in transit and confirming the identity of the sender. It is used when integrating with SOAP APIs that require request signing for security. SOAP Digital Signature is available on No Authentication, WSSE Username Token Profile, and Custom SOAP Header service types. See SOAP Digital Signature Concepts for more detail.
| Setting | Required | Description |
|---|---|---|
| Enable SOAP Digital Signature | — | When checked, this setting enables digital signing for SOAP requests. |
| PFX or PKCS12 Encoded Private Key and Certificate Chain | No | The private key and certificate chain in PFX or PKCS12 format, hex encoded. Displays when Enable SOAP Digital Signature is checked. |
| PFX Passphrase | No | The passphrase for the PFX file. Displays when Enable SOAP Digital Signature is checked. |
| Signing Algorithm | No | The XML digital signature signing algorithm URI. Displays when Enable SOAP Digital Signature is checked. |
| Digest Algorithm | No | The XML digital signature digest algorithm URI. Displays when Enable SOAP Digital Signature is checked. |
| Canonicalization Algorithm | No | The XML canonicalization algorithm URI. Displays when Enable SOAP Digital Signature is checked. |
Changelog
| Date | Change |
|---|---|
| — | Initial publication. |