Store an existing secret

Import an API key, token, password, private key, or signing secret as an encrypted Credential.

Use the platform-provided Paste a secret method when an external system has already issued material and no CredentialProvider should mint or refresh it.

Before you begin

• Obtain the secret from its authoritative system.
• Choose the namespace containing the Resource that will consume it.
• Choose a recognizable lowercase name. The value is never shown again after creation.

Do not place secret material in source code, deployment archives, Resource configuration, analytics, or agent input.

Steps

1. Open Credentials in the Console.
2. Select Create credential.
3. Choose Paste a secret.
4. Enter a name using lowercase letters, numbers, and hyphens.
5. Paste the secret and select Create credential.

Constal encrypts the value immediately, creates an active version, and records only metadata and a keyed fingerprint in the Credential view.

Verify

Open the new Credential and confirm:

• status is Active;
• creation method is Pasted secret;
• last used is Not used yet;
• version history contains one active version.

Next, bind it to a Resource's Credential slot. A Credential by itself grants no agent capability.

Replace the value

Open the Credential action menu and add a version. Activate the scheduled version after the consuming system accepts it. If uninterrupted rollover is required, use a CredentialProvider with a defined overlap and verification lifecycle instead of manual replacement.

Troubleshooting

• The Resource cannot use the secret: verify that its Driver expects the slot and that credential:use Policy allows the authenticated invocation.
• The wrong customer receives the secret: use a customer-scoped selector; never accept a Credential CRN from agent input.
• The value needs automatic refresh: install a CredentialProvider and create a managed Credential instead.

Next steps

Read Use a credential from an agent and Scoped bindings.