# Credentials

## Introduction

Credentials are upstream API secrets for **managed** pools. You enter a secret
once. The dashboard never keeps it, not even a hash, and never echoes it back.
The pool encrypts it on save and decrypts it only inside an isolated sandbox to
reach your origin. Attach one credential to any number of managed pools;
rotating it updates every pool that uses it.

Manage credentials under **Credentials** in the dashboard.

## Create a credential

1. Open **Credentials → Add credential**.
2. Name it and choose an auth method (bearer, basic, API key, OAuth 1.0,
   OAuth2 client-credentials, or OAuth2 refresh token).
3. Enter the secret fields and save.

## Attach to a pool

On a managed pool's **Settings**, select the credential. It applies to new
requests within a few seconds.

Pass-through pools do not use credentials. Callers supply upstream auth on
each request.

## OAuth 2.0 client credentials

Choose how the pool authenticates at the token URL:

- **Client secret** — HTTP Basic with client id and secret (default).
- **Private key JWT** — the pool signs a short-lived JWT (`private_key_jwt`) and
  posts it as `client_assertion`. Paste a private key, or use **Generate
  certificate** to mint an RSA key plus a self-signed public certificate. Download
  the certificate for IdPs that ask you to upload one (for example NetSuite
  OAuth 2.0 M2M). After mapping, paste the IdP’s certificate id into
  **Certificate ID** (`kid`). Algorithm defaults to PS256; RS256 and ES256 are
  also available.

The private key is sealed at the pool like any other secret. The public
certificate is shown once for download and is not stored.

## OAuth 2.0 refresh token

Use this when the origin issues access tokens from a stored refresh token
instead of a client-credentials grant. Amazon SP-API (Login with Amazon) is
the usual case: one developer app, one refresh token sealed at the pool, many
callers with pool keys.

Set the token URL and the header the access token is attached as. For Amazon
SP-API that is `https://api.amazon.com/auth/o2/token` and
`x-amz-access-token`. The pool exchanges the refresh token, caches the access
token, and attaches it as that header. Callers never see the refresh token
or client secret.

See [Front Amazon SP-API](/docs/knowledge-base/amazon-sp-api).

## Rotate

Rotate from the Credentials page. Pools that reference the credential pick up
the new secret within a few seconds without changing pool keys or client config.

## Next steps

- [Pool settings](/docs/pools/settings)
- [Access](/docs/pools/access)