> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Callback credentials

> Create, rotate, and revoke the tokens that authenticate exception callbacks from an external system, in the Matcher module of Lerian Console.

The **Callback Credentials** screen in the Matcher module of Lerian Console manages the tokens that an external system, such as a ticketing system, sends with its exception callbacks. For the API workflow, see [Webhooks and callbacks](https://docs.lerian.studio/en/products/matcher/integrations/matcher-webhooks-callbacks.md).

## Accessing the Callback Credentials page

***

Go to **Settings → Callback Credentials**. You need the permission to read callback credentials to open the screen.

## Credentials table

***

| Column | Description |
| - | - |
| **External system** | The label of the system that uses the credential. |
| **Status** | **Live** or **Revoked**. |
| **Created At** | When the credential was created. |
| **Last used** | When the credential last authenticated a callback, or **Never used**. |
| **Rotated** | When the credential replaced an earlier one through **Rotate**. |

## Creating a credential

***

1. Click **New Credential**.
2. Enter an **External system** label. The label is not a secret.
3. Click **Create credential**.

Matcher shows the token once, as the **X-Callback-Token header value**, with the **Callback URL shape**. Give the token to the external system, and click **I've saved the token**. You cannot see the token again, and Matcher keeps only its hash.

## Rotating a credential

***

Open the actions of a credential and click **Rotate**, then confirm. The old token stops authenticating callbacks at once. The old credential shows as **Revoked**, and a new **Live** credential with the same label appears in the table. Matcher shows the new token once. Give it to the external system before its next callback.

## Revoking a credential

***

Open the actions of a credential and click **Revoke**, then confirm. The token stops authenticating callbacks at once. You cannot undo this action. To let the external system send callbacks again, create a new credential.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.