# Set up a credential provider

> Install a provider package, configure its application details, and securely bind bootstrap secrets.

A provider package defines lifecycle code. Setting it up creates a configured provider instance in one namespace. One installed instance can create many output Credentials.

## Before you begin {#before-you-begin}

- Create the external application or service account required by the integration.
- Collect its non-secret identifiers and required secrets.
- Register any callback URL shown by the Console exactly as displayed.
- Confirm the package's intended authority and required external permissions.

## Steps {#steps}

1. Open **Credentials**, then **Providers**.
2. Select **Add provider**.
3. Choose the authentication behavior, not merely the service name.
4. Enter the required application details. These are rendered from the package configuration schema.
5. Paste each bootstrap secret, or select an existing Credential when the same application secret is already governed in this namespace.
6. Expand **Advanced options** only when you need a second provider instance or a custom Resource name.
7. Select **Set up provider**.

Inline secrets are converted into separate encrypted Credentials before the immutable provider Resource is registered. Provider code receives them only through its declared bootstrap slots.

## Verify {#verify}

The completion view should identify the provider as ready. In the Providers tab, confirm its provisioning behavior and Credential count. Create a first Credential and verify the expected behavior:

- authorization provider: a browser authorization begins;
- mint provider: material is created and verified;
- import provider: operator material becomes active immediately.

## Multiple instances {#multiple-instances}

Install multiple instances when a tenant owns multiple external applications, regions, or security domains. Give each instance a unique name and bind the correct instance when creating Credentials. Package code remains immutable; instance configuration and bootstrap Credentials differ.

## Troubleshooting {#troubleshooting}

- **No provider choices:** install a private package or ask the platform administrator to make a managed package available.
- **Callback mismatch:** copy the exact HTTPS callback without parameters or a trailing variation.
- **Bootstrap Credential conflict:** choose a new provider instance name or select the intended existing Credential.
- **Package rejected:** review [Provider package format](/docs/credentials/providers/package-format.md).

## Next steps {#next-steps}

Create a Credential, then follow [Use a credential from an agent](/docs/credentials/use-from-agent.md).