## 4.1.4.2.1.4.1  Configure the Credential Type for HTML5 Application Repository Service Instances
When you create an HTML5 application repository service instance key or bind a service instance to an application, values for client\_id and client\_secret are generated. The client\_secret is the equivalent to a password.
As of January 28, 2021, the credential type binding\_secret is automatically used for the client\_ secret value of new HTML5 application repository service instance keys. This increases the security because the credential type binding\_secret creates a new client\_secret for each binding and service key.
If you have older HTML5 application repository service instances, the client\_secret value is the same for all bindings and service keys because the HTML5 application repository still uses the credentials type instance\_secret for older HTML5 application repository service instances. To configure the more secure credential type binding\_secret for your older HTML5 application repository service instances, please follow the instructions in Configure the Credential Type binding\_secret for HTML5 Application Repository Service Instances [page 433].
As an alternative to the credential type binding\_secret , you can also use the credential type x.509 to authenticate your apps with X.509 certificates. For more information, see Credential Type x509 for HTML5 Application Repository Service Instances [page 435].
## Configure the Credential Type binding\_secret for HTML5 Application Repository Service Instances
1. Extract the UUID part of the xsappname from the of the existing instance. For example:
1. 
2. 
3. Copy the UUID. In this example: fec39a25-a570-46b0-8ac9-1691f8d663cc
2. Create a file instance-xs-security.json , such as the following:
3. Update the service instance:
4. Check that the instance now creates binding secrets as follows:
1. 
2. 
```
Sample Code cf create-service-key <serviceInstanceName> <serviceInstanceKeyName>
```
```
Sample Code cf service-key <serviceInstanceName> <serviceInstanceKeyName> …… "clientsecret": "HksDYy9RxYFUQeOHIzprqBam3vQ=", //Old instance secret … "xsappname": " fec39a25-a570-46b0-8ac9-1691f8d663cc !b6711|html5-appsrepo-uaa!b6711", ……
```
```
 Sample Code { "xs-security": { "xsappname": " fec39a25-a570-46b0-8ac9-1691f8d663cc ", "oauth2-configuration": { "credential-types": ["binding-secret"] } }
```
```
 Sample Code cf update-service <serviceInstanceName>  -c instance-xs-security.json
```
```
Sample Code cf create-service-key <serviceInstanceName> <serviceInstanceKeyNameNew> Sample Code cf service-key <serviceInstanceName>  <serviceInstanceKeyNameNew>
```
```
…….. "clientid": "sb-fec39a25-a570-46b0-8ac9-1691f8d663cc!b6711|html5-appsrepo-uaa!b6711", "clientsecret": " 8c902673-00d4-471f-9ebb-4463d4073fda$7NIo5batSFZCF1RNGcpNkRfo4mDj6vqcElDFIcvcwg=", //New binding secret (long) "identityzone": ….., "identityzoneid": ….., …….
```
## Credential Type x509 for HTML5 Application Repository Service Instances
To use the HTML5 application repository service and authenticate with X.509 certificate, you need to acquire the required key, certificate, and base URLs. These are provided when you create an instance of the HTML5 application repository service and a binding or a service key for the instance.
When you bind an HTML5 applications repository service instance to an application, you have to explicitly provide the required configuration parameters for the authentication with x.509:
```
cf bind-service <application> <service-instance> -c parameters.json
```
The same applies if you create service keys:
cf create-service-key &lt;service-instance&gt; &lt;key-name&gt; -c parameters.json
The configuration for the credential type x509 must be wrapped with xsuaa. You have to use exactly the following format for the configuration:
```
{ "xsuaa": { "credential-type": "x509", "x509": { "key-length": 2048, // specifies the byte length of the generated private key, // defaults to 2048 "validity": 7, // specifies the number of time units in validity-type, // defaults to 7, thus the complete validity defaults to 7 days "validity-type": "DAYS" // specifies the validity time unit, // only DAYS, MONTHS and YEARS are supported, // defaults to DAYS } } }
```
##  Note
The following applies to existing HTML5 application repository service instances:
Before you create a binding to a service instance or a service key as described above, you have to update of the service instance of your existing HTML5 application repository service instance. Use parameters to provide the configuration during the update of the existing service instance:
```
cf update-service <service-instance> -c update-instance-xs-security.json
```
To configure the credential type x509 for existing HTML5 application repository service Instances, please follow the instructions below:
## Configuring Credential Type x509 for Existing HTML5 Application Repository Service Instances
To configure the credential type x509 for your existing HTML5 application repository service instances, perform the following steps:
1. Extract the UUID part of the xsappname from the service key or the binding for the service instance. For example:
```
1.  Sample Code cf service-key <serviceInstanceName> <existingServiceInstanceKeyName>
```
```
…… "clientsecret": "HksDYy9RxYFUQeOHIzprqBam3vQ=", //Old instance secret … "xsappname": " fec39a25-a570-46b0-8ac9-1691f8d663cc !b6711|html5-appsrepo-uaa!b6711", ……
```
2. Copy the UUID. In this example: fec39a25-a570-46b0-8ac9-1691f8d663cc
2. Create a file update-instance-xs-security.json with the following format:
3. Update the service instance:
```
 Sample Code { "xs-security": { "xsappname": "fec39a25-a570-46b0-8ac9-1691f8d663cc", //The UUID that was extracted before "oauth2-configuration": { "credential-types": ["x509"] } }
```
cf update-service &lt;serviceInstanceName&gt; -c update-instance-xs-security.json
4. Create a file parameters.json , such as the following: :
```
 Sample Code { "xsuaa": { "credential-type": "x509", "x509": { "key-length": 2048, "validity": 7, "validity-type": "DAYS" } } }
```
(Note that the values of the "x509" properties used here are just examples.)
5. Create a binding or a service key with the credential type x509 configuration ( parameters.json file). For example:
cf create-service-key &lt;serviceInstanceName&gt; &lt;serviceInstanceKeyNameNew&gt; -c parameters.json
6. Check that the instance now creates a certificate and that the credential-type is "x509", as follows:
cf service-key &lt;serviceInstanceName&gt; &lt;serviceInstanceKeyNameNew&gt;
The following binding is generated as a result:
```
{ ...... "certificate": "-----BEGIN CERTIFICATE-----...-----END CERTIFICATE----\n-----BEGIN CERTIFICATE-----..-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----\n", "clientid": "........", "credential-type": "x509", ...... }
```