# Store an existing secret

> Import an API key, token, password, private key, or signing secret as an encrypted Credential.

Use the platform-provided **Paste a secret** method when an external system has already issued material and no CredentialProvider should mint or refresh it.

## Before you begin {#before-you-begin}

- Obtain the secret from its authoritative system.
- Choose the namespace containing the Resource that will consume it.
- Choose a recognizable lowercase name. The value is never shown again after creation.

Do not place secret material in source code, deployment archives, Resource configuration, analytics, or agent input.

## Steps {#steps}

1. Open **Credentials** in the Console.
2. Select **Create credential**.
3. Choose **Paste a secret**.
4. Enter a name using lowercase letters, numbers, and hyphens.
5. Paste the secret and select **Create credential**.

Constal encrypts the value immediately, creates an active version, and records only metadata and a keyed fingerprint in the Credential view.

## Verify {#verify}

Open the new Credential and confirm:

- status is **Active**;
- creation method is **Pasted secret**;
- last used is **Not used yet**;
- version history contains one active version.

Next, bind it to a Resource's Credential slot. A Credential by itself grants no agent capability.

## Replace the value {#replace-the-value}

Open the Credential action menu and add a version. Activate the scheduled version after the consuming system accepts it. If uninterrupted rollover is required, use a CredentialProvider with a defined overlap and verification lifecycle instead of manual replacement.

## Troubleshooting {#troubleshooting}

- **The Resource cannot use the secret:** verify that its Driver expects the slot and that `credential:use` Policy allows the authenticated invocation.
- **The wrong customer receives the secret:** use a customer-scoped selector; never accept a Credential CRN from agent input.
- **The value needs automatic refresh:** install a CredentialProvider and create a managed Credential instead.

## Next steps {#next-steps}

Read [Use a credential from an agent](/docs/credentials/use-from-agent.md) and [Scoped bindings](/docs/credentials/scoped-bindings.md).