Skip to main content
A credential is a named secret: a password, an SSH private key, a token or an API key. Agents use credentials to log in to hosts and to run commands. 2501 also uses them to connect to jump hosts, gMSA configurations, satellite clusters, LLM providers and plugins. Credentials has the setup steps.

​
Where the Value Is Kept

The type of a credential tells where 2501 gets its value. 2501 never shows a value after you save it. To change a value, edit the credential and enter the new value.

​
Agents and Credentials

An agent uses a credential in two ways:
  • To log in to its host. A role tells how the agent uses each credential: the login, the password or the SSH key. See assigning credentials to agents.
  • By name in a task. The agent writes {{secret:<name>}} in a command or a plugin call, and 2501 puts in the value when the command runs. The agent can use only the credentials on its allowlist.
The model sees the names and the descriptions of the credentials. It never sees their values.

​
Secrets Found During a Task

2501 also masks a secret value that a task reads from a host or a tool, even when it isn’t one of its named credentials - a Kubernetes Secret fetched through a tool, a value in a .env file the agent reads, or a password a command echoes. It appears as a {{secret:name}} placeholder instead of its raw value in the task timeline, in stored messages, and in the requests sent to your LLM provider.

​
Credentials and Organizations

A credential belongs to one organization or to the tenant. An agent can use the credentials of its organization and the tenant-wide credentials. When both have a credential with the same name, the agent uses the credential of its organization. See Organizations.

​
PAM Accounts

A PAM system is the privileged access management system that keeps your account passwords. A credential of the PAM account type names a PAM system and a path. 2501 reads the value when a task starts to use the credential. CyberArk. A task reads each path one time. The next task reads the path again. Thus, a task uses the new password after CyberArk rotates it. WALLIX. A task checks out each account one time, and 2501 checks it in when the task ends. At check-in, WALLIX can rotate the password. Tasks that use the same account at the same time share one checkout. Outside a task, 2501 keeps the value for 5 minutes. Privileged access has the setup steps.

​
Session Proxies

A session proxy is the part of a PAM system that opens SSH sessions for its users. CyberArk calls it PSM for SSH, and WALLIX Bastion calls it the SSH proxy. When a host uses a session proxy, 2501 never connects to the host and never gets its password or key. 2501 signs in to the proxy with the user of the PAM system. The agent username names the account, for example root@srv42. The PAM system gets its password or key from the vault, then opens and records the session. 2501 opens one session for each command that runs at the same time, so a task can show more than one session. A sign-in test shows as a refused session for the account 2501-test.