RPA Credential Management in Bots

A bot logs into SAP, Outlook, a web portal, and a database — often multiple times per day. Each login requires a username and password. Where do those credentials live? Who can see them? What happens when a password expires? Credential management answers these questions with a system that is both secure and practical.

The Four Wrong Ways to Handle Credentials

 WRONG WAY 1: Hardcode in the workflow
 ─────────────────────────────────────────────────────
 Type Into [Password Field] "P@ssw0rd123"
 Problem: Anyone who opens the .xaml file sees the password.
          If the file is shared or version-controlled, it leaks.

 WRONG WAY 2: Store in a config file
 ─────────────────────────────────────────────────────
 Read "password" from Config.xlsx row 5
 Problem: The Excel file is readable by anyone with file access.
          No encryption. No audit trail.

 WRONG WAY 3: Ask the bot developer to remember them
 ─────────────────────────────────────────────────────
 Problem: Developer leaves the company → bot stops working.
          No documented source of credentials.

 WRONG WAY 4: Use a shared human account
 ─────────────────────────────────────────────────────
 Problem: Human account is deactivated when employee leaves.
          Audit trail is mixed with human actions.
          Password changes break the bot without warning.

The Right Way: Orchestrator Credential Store

All RPA platforms provide a secure, encrypted vault for storing credentials. In UiPath, this is the Orchestrator Credential Store. Credentials are encrypted at rest and in transit. The bot retrieves them at runtime — never storing them in its own code or files.

Credential Storage and Retrieval Flow

 ADMIN STORES CREDENTIAL:
 ─────────────────────────────────────────────────────
 Orchestrator → Credentials → Add
 Name: "SAP_AP_Bot_Credentials"
 Username: "sap_rpa_bot"
 Password: "P@ssw0rd!2024" (encrypted immediately on save)
 → Stored encrypted in Orchestrator database

 BOT RETRIEVES CREDENTIAL AT RUNTIME:
 ─────────────────────────────────────────────────────
 Get Credential activity
 Asset Name: "SAP_AP_Bot_Credentials"
 Output: username (String), securePassword (SecureString)

 The securePassword variable holds the password in memory
 as an encrypted SecureString — it is never a plain text String.

 Type Into [Password Field]
 Text: securePassword (passed as SecureString, not typed as text)

SecureString — Why It Matters

UiPath uses SecureString for passwords — a .NET type that encrypts the string in memory rather than storing it as plain text. Even if someone takes a memory dump of the bot's process, they cannot read the password from it. Never convert a SecureString to a regular String unless absolutely necessary, and if you must, clear the variable immediately after use.

Credential Rotation

Most organisations require passwords to change periodically — every 30, 60, or 90 days. When a bot's credential expires, the bot fails to log in and raises an alert. A well-managed credential rotation process prevents this disruption:

 CREDENTIAL ROTATION PROCESS:
 ─────────────────────────────────────────────────────
 1. IT team or RPA Admin generates new password for bot account
 2. New password updated in Orchestrator Credential Store
    (Bot code does not need to change)
 3. Password changed in the target system (SAP, web portal, etc.)
 4. Test bot login to confirm new credential works
 5. Done — bot resumes normal operation with new password

 Best practice: Schedule this quarterly; track expiry dates
                in a credentials register maintained by the CoE.

Third-Party Secret Vaults

Enterprise organisations often use dedicated secret management platforms — CyberArk, HashiCorp Vault, or Azure Key Vault — to manage all service account credentials centrally. UiPath integrates with these vaults so bot credentials are managed in the enterprise vault rather than the Orchestrator's built-in store.

Credential Audit Trail

Every time a bot retrieves a credential from the vault, that retrieval is logged — which bot, which credential, at what time. This audit trail helps detect unusual access patterns that might indicate a compromised bot or unauthorised use.

Multi-Factor Authentication (MFA) Challenge

Some enterprise systems enforce MFA — a second authentication factor (like a mobile OTP) in addition to username and password. Standard bots cannot receive an OTP on a phone. Solutions include:

• Requesting an MFA exemption for the bot's service account (most common — with additional compensating security controls)
• Using a software-based authenticator that generates TOTPs, which the bot can read from a secure store
• Using certificate-based authentication as a more secure MFA alternative

Summary

Credential management is a foundational security requirement for any production RPA bot. Store all credentials in the Orchestrator Credential Store or an enterprise vault like CyberArk or Azure Key Vault. Use SecureString for passwords in memory. Implement a formal credential rotation process to prevent expiry-related failures. Log all credential retrievals for the audit trail. Never hardcode credentials in workflow code, config files, or documentation. A credential management failure exposes every system the bot accesses — treating it with the same rigour as any enterprise identity management programme is the only acceptable standard.