Device credentials vault

The credentials vault stores logins for the equipment you install, such as an admin password, an API key, or a device's IP address, so your team has what it needs on site without hunting through email threads.

Before you start

Credentials use the same tickets permission as tickets, RMA, and maintenance plans. You need edit access to add, edit, or delete one.

Add a credential

1. Open a project's Credentials tab, or the org-wide Credentials page under the sidebar (which lists every credential across all your projects).
2. Click Add credential and give it a name.
3. Optionally link it to an installed unit or a catalog product, so it's clear which device it belongs to.
4. Fill in a username, secret, host or IP, port, and URL as needed. Any field can be left blank.
5. Add a note if there's context worth keeping (a login quirk, a reset procedure).
6. Click Save credential.

Reveal a secret

Secrets are hidden by default in the table, shown as dots. Click the eye icon next to a credential's secret to fetch and display it, and the copy icon to copy it to your clipboard. The secret is not loaded until you ask for it.

How the security actually works

It matters to be precise here rather than to oversell it:

• Secrets are encrypted at rest with AES-256-GCM. The encryption key lives only in the server's environment configuration, never in the browser and never in the database alongside the ciphertext.
• The browser only ever receives plaintext when you explicitly click reveal, through a server-side action. It is not included in the normal list or edit views.
• Access to a credential is controlled the same way as the rest of your data: row-level security scopes it to members of your organization who can see the project it belongs to, and to the tickets capability for editing.
• There is no separate password or step-up check in front of reveal beyond your normal login and role. Anyone with edit or view access under your org's role settings for tickets can reveal a secret once they are looking at it, the same as they could see the record itself.
• The AI assistant has no tool that reads this table under any circumstance, by design.

Treat the vault as equivalent in sensitivity to any other record your team can see, not as a separate, harder-walled safe. Keep who has edit access on tickets deliberate if the credentials stored are sensitive.

Tips

• The org-wide Credentials page is read-only metadata (name, login, project); click a row to jump to the full record on its project, where the secret actually lives.
• Deleting a credential is immediate and permanent, there is no undo.