Skip to main content
mTLS (Mutual TLS) certificates enable mutual authentication between your application and external servers. This feature allows you to use client certificates to authenticate with APIs that require mutual TLS authentication.

​
Access certificates

To manage your mTLS certificates, go to Settings > Certificates. This section lets you manage all certificates associated with your company.
The certificates section is not available for self-service companies.
Full view of the mTLS certificates section showing the list of certificates with their names, expiration dates, and options to mark them as primary

​
Create certificate

Click Create at the top of the list to open a side panel with these fields:
Panel to create a new mTLS certificate with options to upload PEM or CRT + KEY files
  • Name (required): up to 100 characters, unique within your company (case-insensitive), and no emojis.
  • Certificate passphrase (optional): if your private key is protected, enter its password. It must be 8 to 128 characters long, with no emojis and no leading or trailing spaces.
  • Certificate file: choose one of the two options below.
You can upload the files in two formats, which are mutually exclusive: when you load one option, the other is cleared and locked.
Each file can be up to 5 MB. Make sure the certificates are valid and have not expired before uploading them. The expiration date is extracted automatically from the certificate.
The Upload button in the panel is enabled only when the name is valid and you have attached the .pem file or the CRT + KEY pair. New certificates are not marked as primary: you can do that later from the list.

​
Option A: separate files (CRT + KEY)

Both files are required:
  • CRT file (.crt or .cer): contains the certificate
  • KEY file (.key): contains the private key

​
Option B: single file (.pem)

A .pem file that contains both the certificate and the private key.

​
View certificates

In the Certificates section you can see all your company’s certificates in a table with these columns:
  • Certificate name
  • Expiration date (for example, Oct 13, 2027; - is shown if there is no date)
  • Primary: a switch that indicates whether it is the primary certificate
  • Actions: icons to edit and delete
The table is paginated at the bottom. If you have not added any certificates yet, you will see the message “No certificates added yet”.

​
Mark a certificate as primary

Turn on the Primary switch for the certificate. This certificate will be automatically selected when you enable mTLS on an API node if you have not manually selected another certificate.
Only one certificate can be marked as primary at a time. If you mark a new certificate as primary, the previous one will automatically lose that status.
While the change is being saved, the switch stays disabled; if the operation fails, it returns to its previous state.

​
Edit a certificate

You can edit the name of your existing certificates to identify them more easily. This is useful when you have multiple certificates for different purposes or environments. Click the edit icon (pencil) in the Actions column next to the certificate you want to modify. The name must follow the same rules as when you created it.
You can only change the name. Files cannot be replaced: to use a different certificate or key, create a new certificate.

​
Delete a certificate

You can delete certificates you no longer need. To delete a certificate, click the delete icon (trash can) in the Actions column; a confirmation modal with the certificate name will open.
You cannot delete the primary certificate: the option appears disabled. First remove its primary status by turning on another certificate.
Before deleting a certificate, the system will show you a warning indicating that you must ensure this certificate is not being used in any API node. If you delete a certificate that is in use, it could cause errors in the API calls of your active flows.

​
Use certificates in API nodes

Once you have certificates loaded, you can use them in the API node by enabling the mTLS certificates option in the Settings section of the node.