Skip to main content
A credential is a named secret: a password, an SSH private key, a token or an API key. Agents use credentials to log in to hosts and to run commands. 2501 also uses them to connect to jump hosts, gMSA configurations, satellite clusters, LLM providers and plugins. Credentials has the setup steps.

​
Where the Value Is Kept

The type of a credential tells where 2501 gets its value. 2501 never shows a value after you save it. To change a value, edit the credential and enter the new value.

​
Agents and Credentials

An agent uses a credential in two ways:
  • To log in to its host. A role tells how the agent uses each credential: the login, the password or the SSH key. See assigning credentials to agents.
  • By name in a task. The agent writes {{secret:<name>}} in a command or a plugin call, and 2501 puts in the value when the command runs. The agent can use only the credentials on its allowlist.
The model sees the names and the descriptions of the credentials. It never sees their values.

​
Credentials and Organizations

A credential belongs to one organization or to the tenant. An agent can use the credentials of its organization and the tenant-wide credentials. When both have a credential with the same name, the agent uses the credential of its organization. See Organizations.

​
PAM Accounts

A PAM system is the privileged access management system that keeps your account passwords. A credential of the PAM account type names a PAM system and a path. 2501 reads the value when a task starts to use the credential. CyberArk. A task reads each path one time. The next task reads the path again. Thus, a task uses the new password after CyberArk rotates it. WALLIX. A task checks out each account one time, and 2501 checks it in when the task ends. At check-in, WALLIX can rotate the password. Tasks that use the same account at the same time share one checkout. Outside a task, 2501 keeps the value for 5 minutes. PAM accounts are available only when the enablePrivilegedAccess feature toggle is on. Privileged access has the setup steps.