Credentials

Credentials allow administrators to declare authentication configurations with external systems, which can then be used in other applications.

Applications may require different credential information depending on the type of endpoint. Medallia Experience Cloud supports a variety of endpoints such as S3 buckets, SFTP, and HTTPS web calls.

Note: Push connectors, such as Red Box connectors, don't use credentials but rely on a connection identifier for their connection profile. For information about this parameter see Get started with Medallia Speech and Connector settings.

Experience Cloud Credentials enable you to create and modify all credentials, and ensures that cryptographic operations needed for confidential data on certain applications are carried out before sending the data to and after retrieving it from persistent storage.

To use and access Credentials, see Accessing Integrations.

Restriction: This feature is inactive by default. Ask your Medallia expert to file a Feature activation request with Medallia Support.

Credentials screen

The Credentials screen allows you to manually and centrally configure credentials. Having a single place to manage credentials makes it easier to manage if you reuse credentials in multiple places. For example: if you create two Speech connectors — one for Spanish and another for English — and they use the same credentials, when you need to update a password, you do it once, not twice.

This screen lists all of the sets of credentials available for that particular company instance. Credentials are sorted by the name and can be filtered by credential type. Use the search bar at the top of the list to search for a particular set of credentials. For example, if you follow a naming convention for credentials based on their type, search can help you locate those credentials more quickly.

Layer 1 1 2 3 4

  1. Details pane

  2. Details pane menu

  3. Search bar

  4. Filter

Details pane

Click a set of credentials to reveal its details pane, which shows the following:
Credential Type
Type of endpoint. This can be: HTTP Web Call, SFTP, S3 Bucket, NICE inContact (Central), NICE inContact (UserHub), and Genesys PureCloud, Five9 and RingCentral Engage.
Created
Date the configuration was created and the user who created it.
Last modified
Date the configuration was last modified and the user who modified it.

Details pane menu

For the selected set of credentials, clickMore vertical icon. the details pane menu to delete the configuration.

The options menu for a set of credentials.

Create and manage credentials

To create a set of credentials, complete the following steps:

  1. From Credentials screen, click New Credentials. This opens the library of available credential types. Additionally, credentials can be created inline within connectors, for more details, see Create and manage connectors.

  2. Select the type of credentials from the list. This opens the Credentials editor, where you can build your credentials.

  3. In the Credentials editor, enter a name and a description.

    1. Enter a name and a description for the new set of credentials.

    2. Enter the credential information required for the type of credentials.

  4. Click Test to verify that the new credentials are valid.

  5. Click Save.

Note: Bear in mind that, once you save the form, passwords, secret and private keys are not displayed on screen and cannot be recovered by Experience Cloud.

Managing credentials

To manage a set of credentials, click Edit to modify its content.

The type of credentials cannot change once a set of credentials has been created.

Passwords, private and secret keys

Once you save a set of credentials, passwords, and secret and private keys are not displayed again. To modify them, click Change and enter the new value.

Screen capture showing Change access key button

Testing credentials

Once you have entered all the authentication information required in the form, test your credentials by clicking Test at the bottom of the screen.

Screen capture showing credential editor with test button highlighted

Test results are displayed next to the Test button. When the test is successful, Click Save to complete the credential-creation process.

Screen capture showing successful test results

HTTP Web Call credentials

Endpoint Base URL
URL to the Web instance.
Authentication Method
Defines the method for client authentication:

  • None

  • Basic Authentication — Authentication scheme that transmits credentials as username/password pairs, encoded using Base64.

  • OAuth 2.0 - Secret — OAuth allows users, applications, and systems to grant access to resources without sharing personal authentication credentials like passwords. Instead, the parties share a secure token that identifies what the user or application may access.

  • OAuth 2.0 - Password — OAuth authentication scheme that exchanges the client's username and password for an access token.

Username
Required when the authentication method selected is "Basic Authentication" or "OAuth 2.0 - Password". Username for the Login account.
Password
Required when the authentication method selected is "Basic Authentication" or "OAuth 2.0 - Password". Password for the Login account.
Client ID
Required when the authentication method selected is "OAuth 2.0 - Secret" or "OAuth 2.0 - Password".

OAuth clients are applications that request or use resources. Client ID is the unique identifier for each client.

Client Secret
Required when the authentication method selected is "OAuth 2.0 - Secret". Pre-authenticated identification associated with the client, and passed to the server when authenticating.
Access Token URL
Required when the authentication method selected is "OAuth 2.0 - Secret". OAuth token endpoint for the Web instance. The URL looks similar to this:
https://<Base URL>/oauth/token
Scope
Requested when the authentication method selected is "OAuth 2.0 - Secret" or "OAuth 2.0 - Password". This credential is optional. Authentication scope of the HTTP web call.

Nice inContact (UserHub)

Below are the required properties to integrate with the UserHub API. For more details see the NICE inContact documentation for UserHub users.

Region
Area specific domains defined by the data center your company connects to. Available domains are:

  • North America (NA)

  • Europe (EU)

  • Australia (AU)

Access Key ID
Application requests that are not made through a browser require an access key. Access keys consist of two keys: an access key ID and a secret access key. Use the access key ID and secret access key together to authenticate your requests.
Secret Access key
Application requests that are not made through a browser require an access key. Access keys consist of two keys: an access key ID and a secret access key. Use the access key ID and secret access key together to authenticate your requests.

Nice inContact (Central)

To integrate with NICE as a Central user, register your application in the NICE inContact Central website to retrieve a token. For more details, see the NICE inContact documentation for Central users.

Username
NICE inContact username.
Password
NICE inContact password.
Application ID
Application ID required to create authorization keys.
Application Name
Application name specified when the app was registered in the NICE inContact Central website.
Vendor Name
Vendor name specified when the app was registered in the NICE inContact Central website.

NICE inContact CXone

Use these credentials to configure and activate NICE in Contact (UserHub) or NICE inContact (Central) connectors that authenticate with the new CXone credential type. For information about this authentication process, see the NICE inContact documentation for UserHub users and the NICE inContact documentation for Central users on this topic.

Client ID
A client is an application that requests or uses resources. Client ID is the unique application identifier assigned by the CXone platform.
Client Secret
Pre-authenticated identification associated with the client, and passed to the server when authenticating.
Public access key
Public user ID to integrate with the CXone platform.
Secret Access Key
Application requests that are not made through a browser require an access key. Access keys consist of two keys: an access key ID and a secret access key. Use the access key ID and secret access key together to authenticate your requests.

Genesys Cloud

For more details see the Genesys Cloud documentation.

Warning: Genesys Cloud is retiring their Chat feature and will be migrating all customers to Web Messaging. This change will have no impact on the credentials used in the connector. Clients, partners, and administrators must migrate to the new service.
Client ID

OAuth clients are applications that request or use resources. Client ID is the unique identifier for each client.

Region
Region your application connects to:

  • US East (Virginia).

  • US West (Oregon).

  • Canada (Central).

  • Europe (Ireland).

  • Europe (London).

  • Europe (Frankfurt).

  • Asia Pacific (Mumbai).

  • Asia Pacific (Tokyo).

  • Asia Pacific (Seoul).

  • Asia Pacific (Sydney).

Note: Genesys PureCloud is available in a number of regions, but a customer's org can only be available in one region at a time.
Client Secret
Pre-authenticated identification associated with the client, and passed to the server when authenticating.

S3 Bucket and Amazon Connect

Tip: You can use your own infrastructure or MMFT to store signal data and metadata files. We recommend MMFT, since it supports the latest file transfer ciphers. To obtain MMFT credentials, contact Medallia Support. See Contact Medallia Support for details.

For more information, see the Amazon Connect documentation.

Bucket name
Name of the S3 bucket that holds the file. Do not include the file path; instead, use the File regex to locate files in subdirectories.
Region Endpoint
Optional. Specify the URL to the S3 region endpoint. Required for any S3 objects stores not part of Amazon Web Services.
Access key
Access key for the account that owns the bucket.
Secret
Secret key for the account that owns the bucket.
Amazon Connect Instance ID
Only required for Amazon Connect buckets. Identifier of the Amazon Connect instance. The Amazon Connect instance ID is the 36-character string at the end of the instance's Amazon Resource Name (ARN).

SFTP and Five9

Tip: you can use your own infrastructure or MMFT to store signal data and metadata files. We recommend MMFT, since it supports the latest file transfer ciphers. To obtain MMFT credentials, contact Medallia Support. See Contact Medallia Support for details.

For more details see the Five9 documentation.

Host
Remote host name.
Port
Port number for the protocol.
Authentication Method
Defines the method for client authentication:
  • Password — Secure FTP using a password for authentication; encrypts both commands and data.
  • Private Key — SFTP using a public/private key pair for authentication.
User Name
Required when the authentication method selected is "Password". Username for the Login account.
Password
Required when the authentication method selected is "Password". Password for the Login account.
Private Key
Required when the authentication method selected is "Private Key". Private key for generating signatures (to verify the connection matches your Public key).

RingCentral Engage

There are differences to integrate with RingCentral Office users and Engage users. Below are the required data to integrate with the Engage API. For more details see the RingCentral Engage documentation.

Username
Username for the Login account used to request a RingCentral platform token, usually in the form of a phone number, like 16507516707. RingCentral accepts both 16507516707 and +16507516707.

Credential from creating the user in RingCentral MVP, also known as RingCentral Office, and then synchronizing the account with RingCentral Contact Center, also known as RingCentral Engage. For information see RingCentral Engage.

Extension
Phone extension.

Credential from creating the user in RingCentral MVP, also known as RingCentral Office, and then synchronizing the account with RingCentral Contact Center, also known as RingCentral Engage. For information see RingCentral Engage.

Password
Password for the Login account used to request a RingCentral platform token.

Credential from creating the user in RingCentral MVP, also known as RingCentral Office, and then synchronizing the account with RingCentral Contact Center, also known as RingCentral Engage. For information see RingCentral Engage.

Client ID

OAuth clients are applications that request or use resources. Client ID is the unique identifier for each client used to request a RingCentral platform token.

API credential from an app in the RingCentral MVP developer portal. You must have your app promoted to production and enter the production client ID. For information see RingCentral Engage.

Client Secret
Pre-authenticated identification associated with the client, and passed to the server when authenticating.

API credential from an app in the RingCentral MVP developer portal. You must have your app promoted to production and enter the production client secret. For information see RingCentral Engage.

Zendesk

To integrate with Zendesk as a verified user, register the name of your integration in the Zendesk Integration Services (ZIS) Registry Service to retrieve a token. For more details, see the Zendesk documentation.

Email address
Email address of the Zendesk user.
API token
API tokens are auto-generated passwords in the Zendesk Admin Center. Enter the API Token generated for the email address of the user.
Sub domain
Subdomain of the Zendesk account.