Credential.
A held identity that is a key, a token, a certificate or a signed request; only in the secrets manager, never returned
Figure 1Credentialspecified
- kind
- definition
- scope
- follows
- key
- store
- vault
- family
- sources
Fields#
| field | type | required | note |
|---|---|---|---|
platform | text | yes | |
kind | one of an API key | a bearer token | OAuth 2 | OAuth 1 | basic | a signed request | a service account | a client certificate | an SSH key | a webhook secret | yes | |
scopes | [text] | yes | as granted, never as asked |
owner | Scope | yes | the platform, or a tenant |
vault_entry | id | yes | |
last_probe | ControlResult | no | |
rotation | duration | no | the rule |
state | Readiness | yes |
Routes that use it#
No route takes or returns Credential directly. The record holds it, and the objects that point at it reach it.