Skip to main content
An integration connects Expira to a provider. Expira reads the expiry dates of what it finds there, adds them as synced assets, and checks again every day.

AWS

ACM, IAM, RDS, Secrets Manager, KMS, Route 53 and more.

GitHub token

The expiry of the token you connect.

GitHub App

Every fine-grained token in your organisations.

GitLab

Access, deploy, runner, trigger and agent tokens.

App Store Connect

Certificates, profiles and Apple Pay merchant certificates.
Only organisation owners and admins can add, edit, sync or remove integrations. Integrations live under Integrations in the dashboard.

​
When integrations sync

Every integration syncs once a day (times in UTC): AWS and App Store Connect sync before alerts go out, so something found that morning can alert the same day. GitHub and GitLab findings alert on the next day’s run. Press Sync on an integration to sync it now.

​
What a sync changes

  • New credentials are added as assets.
  • Changed credentials are updated: expiry, name and link.
  • Deleted credentials are removed from Expira, with their alert history. Expira only removes an asset after a complete listing of that category. If the provider returns an error, refuses access or stops part-way, nothing in that category is removed.
  • Tokens that expired more than 30 days ago are removed, because providers keep listing expired tokens that were never revoked.
After a sync the card shows a summary such as “Sync complete — 3 new, 1 updated, 0 removed assets.” or the errors it hit. See Troubleshooting.

​
What counts as an integration connection

Each connected account or token is one connection: for example one AWS account, one GitHub App, or one GitLab instance. Plans allow:

​
What Expira stores

  • The credential you connect is stored encrypted in Supabase Vault and is never sent back to your browser. When you edit an integration the field stays empty: leave it blank to keep the stored credential.
  • Expira uses it only to read expiry information from that provider, once a day and when you press Sync.
  • From the provider, Expira keeps only metadata such as names, expiry dates and links. It never stores the secret values of the credentials it discovers.
  • Use a dedicated, read-only credential with its own expiry date. Expira can then remind you to renew it too.

​
Pause or remove an integration

  • Pause stops daily syncs and keeps its assets. Resume starts them again.
  • Remove deletes the stored credential and stops syncing. You choose what happens to the assets it found:
    • Delete them permanently, including their alert history.
    • Keep them as editable manual assets.