Manage Credentials with the CLI

Discover and install providers, create or authorize Credentials, rotate versions, inspect use, and manage scoped assignments safely.

Before you begin

Choose the correct Credential Provider and ownership scope. Prepare non-secret configuration separately from bootstrap or imported material. Never put secrets in --body inline JSON or an ordinary command argument; use a protected file or stdin.

Steps

1. Discover catalog packages and installed providers with credentials providers catalog and credentials providers list.
2. Install a package instance using reviewed setup JSON: constal credentials providers install --body @provider-setup.json. Bootstrap secret files should have owner-only permissions and be removed after setup.
3. Create a Credential. Imported material uses --material-file or --material-stdin; minted providers accept configuration but reject caller material:

constal credentials create github-user \
  --provider crn:constal:production:acme:default:credential-provider/github-oauth \
  --configuration @github-user.json --output json

4. If the response contains an authorization URL, open it as the intended user and complete the provider’s consent flow.
5. Use version, activate, rotate, authorize, or revoke for explicit lifecycle work. Inspect consumers, uses, and events without exposing material.
6. Manage tenant, customer, or principal selection through the bindings command group.

Verify

Confirm state, active version, expiry, fingerprint, provider, and expected consumer. Exercise one low-risk Resource operation and verify the intended scoped assignment was pinned into the Run. Ensure command output and logs contain no secret bytes.

Next steps

Read Use Credentials with the SDK, Credential lifecycle, Scoped bindings, and the generated Credentials command reference.