---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Integration]
keyword: [Extend, Orchestration Builder, Orchestrate, Orchestration]
nav: wcp_docs
parent_url: /wcp_docs/
title: Configure PGP Encryption
layout: subsection
---

### Prerequisites

Security: <i>Security Administration</i> domain in the System functional area.

### Context

PGP encryption provides a secure mechanism for encrypting, decrypting, signing, and verifying sensitive data, ensuring it remains fully protected at rest in cloud storage like AWS S3, and in transit across file transfer services like SFTP. On an Orchestration's Settings page, you can create a credential configuration that references PGP credentials you created on your tenant. You can then invoke that configuration using Orchestrate Expression Language functions.

### Steps

1.  To create PGP credentials for import, access the <b>Create Integration CredStore</b> task in Workday. This task enables you to create a secure credential management service that you can reference in Orchestration Builder, rather than have your orchestration handle credentials itself.
2.  Complete the fields described in this table, then click <b>OK</b>.

<table><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td>App ID</td><td>The unique identifier for the developer site application that will use the Integration Credstore. Available on the developer site as Application Reference. Example: myextendapp2_weqef. An Integration Credstore can map to only 1 application.</td></tr><tr><td>External Reference ID</td><td>A unique identifier for these credentials that you can reference in Orchestration Builder.</td></tr><tr><td>Functional Feature Service Mapping</td><td>Select Workday Orchestrate.</td></tr><tr><td>Token Type</td><td>Select PGP Public Key or PGP Private Key.</td></tr><tr><td>Token Data</td><td>The Base64-encoded ZIP file containing the keystore/truststore files.</td></tr><tr><td>Keystore Password</td><td>The password for the keystore (encrypted at rest).</td></tr><tr><td>Truststore Password</td><td>The password for the truststore (encrypted at rest).</td></tr><tr><td>Expiration Time</td><td>(Optional) The expiration date for this Credstore, entered in ISO 8601 format.</td></tr><tr><td>Descriptor</td><td>A description of this Credstore.</td></tr></tbody></table><br/>

3.  In Orchestration Builder, access the <b>Settings</b> page for the orchestration for which you want to configure PGP encryption.
4.  On the <b>Settings</b> page, select <b>PGP Auth</b>.
5.  Provide a <b>Name</b> for the configuration.
6.  Click <b>Connect to a Tenant</b> to import PGP credentials from your tenant. Alternatively, follow the steps below to enter the details manually.
7.  In the <b>External Reference ID</b> expression field, refer to the External Reference ID of the Credstore you created on your tenant .
8.  (Optionally) Enter the <b>Token Type</b> that the Credstore is configured to use.
9.  (Optionally) Enter a <b>Description</b> for the configuration.
10. Click <b>Create</b>.


### Result

You can now reference the credential configuration using the`pgpDecrypt`, `pgpDecryptAndVerify`, `pgpEncrypt`, and `pgpSignAndEncrypt` functions associated with the Data instance type.