Overview

Credential Expiry Reminders in the Integrations section let you track when a connection's credentials (API keys, tokens, OAuth secrets, certificates) will expire and automatically notify the right people before they lapse. Instead of discovering that a Workday or ServiceNow connection has stopped working because its credentials silently expired, you configure an expiry date and reminder schedule once — and the system emails your admins ahead of time so they can rotate credentials before syncs and workflow actions break.

Credential expiry is configured per connection when you create or edit it, and the resulting credential status (Active, Expiring, Expired) is shown for every connection under Integrations → Connections on the dashboard.

---

How Credential Expiry Reminders Work

When you set an expiry policy on a connection, the system records the credential's expiration date and a reminder lead time (how far in advance you want to be warned). In the background it schedules a reminder tied to that connection's expiry date, reminder time, and timezone.

Once the reminder window opens — i.e. you are within the lead time you configured — the system sends an email notification to the configured recipients and then re-schedules the next reminder automatically. Reminders recur (about once a day, at your configured reminder time) as expiry approaches and passes, so the issue stays visible until it's resolved.

The reminder email adapts to where the credential is in its lifecycle:

• Before expiry — "Credentials expiring in N days"
• On the expiry day — "Credentials expiring today"
• After expiry — "Credentials Expired"

Reminders stop automatically in two situations: when you update the connection's credentials (which reschedules or clears reminders), or when the credential has been expired for more than 90 days (a built-in cutoff that prevents indefinite notifications for abandoned connections).

---

Expiry Policy Options

When configuring a connection you choose an expiry policy that tells the system how to determine the credential's expiration date. The available options are:

For every option except Custom date, the expiration date is calculated automatically from the credential creation date you provide (plus the selected window). For Custom date, you supply the absolute expiration date yourself. Choosing Never disables reminders entirely for that connection.

---

Configuring Credential Expiry Reminders

Credential expiry is set up as part of the connection's create or edit form. Configuration falls into three groups: the expiry policy, the reminder schedule, and the recipients.

Expiry settings

Define when the credentials expire.

Reminder schedule

Define how far in advance and at what time reminders are sent.

* Required when the policy is anything other than Never.

Example: "Start reminders 7 days before expiry, at 10:00:00 in Asia/Kolkata" means the first reminder is sent 7 days ahead of the expiration date, at 10 AM IST, and recurs daily until the credentials are updated.

Recipients

Define who gets notified.

The two recipient modes behave as follows:

• All system admins — reminders go to every dashboard user holding an admin/agent role for the Integrations & Workflows modules (System Admin, Workflows Admin/Agent, Workflow V2 Admin/Agent, FlowGPT Admin/V2 Admin). The recipient list is resolved dynamically at send time, so it always reflects your current admins.
• Specific users — reminders go only to the users you explicitly select.

All reminders are delivered by email.

Validation

The form enforces a few rules when you save:

• The expiration date must be after the creation date and in the future.
• The credential creation date cannot be in the future.
• The reminder lead time cannot exceed the expiry window — you can't ask to be reminded 30 days before expiry on a credential that only lasts 15 days.

---

Managing Credential Expiry Reminders

Credential expiry is managed from the connection itself and from the connections listing.

Edit — Open a connection and change its expiry policy, dates, reminder schedule, or recipients. When you change the schedule, the system discards the old pending reminders and reschedules from the new settings. If nothing schedule-relevant changed, existing reminders are left untouched.

Turn off reminders — Set the connection's expiry policy to Never. Any pending reminders for that connection are discarded and no further reminders are sent.

Renew credentials — Update the connection with a new creation/expiration date. This reschedules reminders around the new expiry, effectively resetting the reminder cycle.

View credential status — The connections listing under Integrations → Connections shows a derived status for every connection and can be filtered by credential status (see below).

---

Credential Status & Reminder Details

Credential status

Every connection displays a derived credential status based on its expiry policy and how close it is to expiring:

You can filter the connections listing by credential status using:

• Approaching Expiration — connections currently inside their reminder window.
• Expired — connections whose credentials have already lapsed.

What a reminder captures

Each scheduled reminder records the connection it belongs to, its scheduled send time, its status, and the recipients captured at schedule time. Reminder emails themselves include the connector/app name, who created the connection and when, and how many days remain until (or since) expiry.

---

Example: Setting up expiry reminders for a Workday OAuth connection

This walkthrough shows how a System Admin configures expiry reminders on a Workday OAuth connection whose API credentials rotate every 90 days. Every field on the form is described — fields you fill in for this scenario are shown with example values, and fields you can leave at their defaults are still listed so you know what's on the page.

Step 1: Open the connection

From the bot dashboard, go to Settings → Integrations → Connections, then create a new Workday connection or open the existing one and switch to Edit. Scroll to the Credential expiry section of the connection form.

Step 2: Set the expiry policy

Because you chose a fixed 90 days window, the expiration date is derived automatically from the creation date. If your credentials had a specific end date instead, you'd pick Custom date and enter it directly.

Step 3: Set the reminder schedule

This reads as: "Begin reminding 7 days before the Workday credentials expire, at 10 AM IST, and keep reminding until they're renewed." The 7-day lead time gives your IT team a working week to rotate the credentials before syncs break.

Step 4: Choose recipients

If you'd rather notify everyone with admin/agent access to Integrations & Workflows, choose All system admins instead and leave the user list empty — the recipients are resolved automatically at send time.

Step 5: Save

Save the connection. Reminders are scheduled immediately. From 2026-03-25 (7 days before the 2026-04-01 expiry) the selected recipients will start receiving daily "expiring in N days" emails at 10 AM IST, followed by an "expiring today" email on 2026-04-01 and "expired" emails afterward — until the credentials are renewed or the connection passes the 90-day post-expiry cutoff.

What happens as expiry approaches

• Recipients receive the reminder email at the configured time, with the connector name and days remaining.
• The connection's credential status updates on the listing — from Credentials Active to Expiring in N days, then Expiring today, then Expired.
• When someone rotates the credentials and updates the connection with a new expiry, the reminder cycle resets around the new date.

Permissions reference

---

Common Use Cases

Rotating OAuth secrets (90-day policy) — Set a 90 days policy with a 7-day lead time on OAuth connections like Workday or SuccessFactors so your team always has a week's notice to rotate the client secret before it lapses.

Fixed-date API tokens (Custom date) — For vendors that issue tokens with a specific end date, use the Custom date policy and enter the exact expiration date, then set a lead time that matches your rotation SLA.

Certificate-based connections — For SharePoint or SAP connections that authenticate with a certificate, set the expiry to the certificate's validity end date so admins are reminded to upload a renewed certificate before it expires.

Team-scoped ownership — Use Specific users to route reminders to the individual owners of each integration (e.g., Workday reminders to the HRIS team, ServiceNow reminders to ITSM) rather than notifying every admin.

Baseline coverage — Use All system admins on connections that don't have a clear single owner, so credential expiry never goes unnoticed.

---

Best Practices

• Set an expiry policy on every credentialed connection. Even a rough date is better than none — the reminder is what prevents silent breakages.
• Match the lead time to your rotation process. If rotating a credential takes your team a few days (approvals, vendor portals), set the lead time longer than that so reminders arrive with room to act.
• Keep the creation date accurate. For fixed-window policies the expiration date is derived from the creation date, so an inaccurate creation date produces an inaccurate reminder schedule.
• Prefer Specific users for owned integrations. Routing reminders to the actual owners gets faster action than broadcasting to all admins.
• Use All system admins as a safety net. For connections without a dedicated owner, notifying all admins ensures the reminder reaches someone.
• Renew before the expiry day. Reminders begin ahead of expiry for a reason — rotating credentials during the lead-time window avoids any sync or workflow downtime.
• Set Never deliberately. Only choose Never for connections whose credentials genuinely don't expire; otherwise you lose the early-warning safety net.
• Confirm the timezone. Reminder time is evaluated in the connection's timezone — set it to your operating team's timezone so the 10 AM reminder lands during working hours.