> ## Documentation Index
> Fetch the complete documentation index at: https://docs.2501.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> How 2501 keeps and uses passwords, keys and tokens

A credential is a named secret: a password, an SSH private key, a token or an API key. Agents use credentials to log in to hosts and to run commands. 2501 also uses them to connect to jump hosts, gMSA configurations, satellite clusters, LLM providers and plugins. [Credentials](https://docs.2501.ai/0.19/configure/credentials.md) has the setup steps.

## Where the Value Is Kept

The type of a credential tells where 2501 gets its value.

| Type | The value is kept in | 2501 reads the value |
| - | - | - |
| **Value** | 2501, encrypted with the [credential key](https://docs.2501.ai/0.19/deployment/configuration.md#secrets) of your installation | Each time it uses the credential |
| **Vault Path** | The HashiCorp Vault of your installation | Each time it uses the credential |
| **PAM account** | A PAM system: CyberArk or WALLIX | One time for each task |

2501 never shows a value after you save it. To change a value, edit the credential and enter the new value.

## Agents and Credentials

An agent uses a credential in two ways:

* **To log in to its host.** A role tells how the agent uses each credential: the login, the password or the SSH key. See [assigning credentials to agents](https://docs.2501.ai/0.19/configure/credentials.md#assigning-credentials-to-agents).
* **By name in a task.** The agent writes `{{secret:<name>}}` in a command or a plugin call, and 2501 puts in the value when the command runs. The agent can use only the credentials on its [allowlist](https://docs.2501.ai/0.19/core-concepts/agents.md#credential-access-control).

The model sees the names and the descriptions of the credentials. It never sees their values.

## Credentials and Organizations

A credential belongs to one organization or to the tenant. An agent can use the credentials of its organization and the tenant-wide credentials. When both have a credential with the same name, the agent uses the credential of its organization. See [Organizations](https://docs.2501.ai/0.19/core-concepts/organizations.md#shared-resources).

## PAM Accounts

A PAM system is the privileged access management system that keeps your account passwords. A credential of the PAM account type names a PAM system and a path. 2501 reads the value when a task starts to use the credential.

**CyberArk.** A task reads each path one time. The next task reads the path again. Thus, a task uses the new password after CyberArk rotates it.

**WALLIX.** A task checks out each account one time, and 2501 checks it in when the task ends. At check-in, WALLIX can rotate the password. Tasks that use the same account at the same time share one checkout. Outside a task, 2501 keeps the value for 5 minutes.

PAM accounts are available only when the `enablePrivilegedAccess` [feature toggle](https://docs.2501.ai/0.19/deployment/feature-toggles.md) is on. [Privileged access](https://docs.2501.ai/0.19/configure/privileged-access.md) has the setup steps.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.