# Manage Credentials with the CLI

> Discover and install providers, create or authorize Credentials, rotate versions, inspect use, and manage scoped assignments safely.

## Before you begin {#before-you-begin}

Choose the correct Credential Provider and ownership scope. Prepare non-secret configuration separately from bootstrap or imported material. Never put secrets in `--body` inline JSON or an ordinary command argument; use a protected file or stdin.

## Steps {#steps}

1. Discover catalog packages and installed providers with `credentials providers catalog` and `credentials providers list`.
2. Install a package instance using reviewed setup JSON: `constal credentials providers install --body @provider-setup.json`. Bootstrap secret files should have owner-only permissions and be removed after setup.
3. Create a Credential. Imported material uses `--material-file` or `--material-stdin`; minted providers accept configuration but reject caller material:

   ```sh
   constal credentials create github-user \
     --provider crn:constal:production:acme:default:credential-provider/github-oauth \
     --configuration @github-user.json --output json
   ```

4. If the response contains an authorization URL, open it as the intended user and complete the provider’s consent flow.
5. Use `version`, `activate`, `rotate`, `authorize`, or `revoke` for explicit lifecycle work. Inspect `consumers`, `uses`, and `events` without exposing material.
6. Manage tenant, customer, or principal selection through the `bindings` command group.

## Verify {#verify}

Confirm state, active version, expiry, fingerprint, provider, and expected consumer. Exercise one low-risk Resource operation and verify the intended scoped assignment was pinned into the Run. Ensure command output and logs contain no secret bytes.

## Next steps {#next-steps}

Read [Use Credentials with the SDK](/docs/credentials/sdk.md), [Credential lifecycle](/docs/credentials/lifecycle.md), [Scoped bindings](/docs/credentials/scoped-bindings.md), and the generated [Credentials command reference](/docs/cli/reference#credentials).