Skip to main content
All glossary terms

Credentials & security

Credential injection

Credential injection is the controlled insertion of a stored credential into a request as it passes through a component that can inspect and modify that request. For HTTPS traffic, rewriting application headers requires TLS termination or inspection; an opaque CONNECT tunnel cannot be rewritten.

Also known as secret injection.

Why it matters in practice

Injection can keep an upstream secret out of application source while still allowing a client to reach a service. The component needs a defined destination, field, and permission boundary, and should avoid exposing the value in logs or responses. TLS inspection requires the client to trust the proxy’s certificate authority and changes the connection’s trust model.

Example

A client places a configured placeholder in a request to api.example.com, and an inspecting proxy replaces it with the bound upstream credential.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.