Browse documentation
Adding a credential
Store a credential once and JOATOS reuses it wherever it needs to authenticate — during discovery and when polling a device or server.
Adding a credential
- Open Settings and select Credentials. (There is no Credentials entry in the top bar.)
- Select Add Credential.
- Fill in:
- Name (required) — a label you'll recognise, e.g. Office SNMP.
- Type (required) — the kind of credential (see Credential types).
- Description (optional) — a note about where it's used.
- The type-specific fields for that credential.
- Select Create Credential.
Where credentials are used
- Discovery — a scan uses a credential to authenticate to a subnet or controller.
- Polling — a device's or server's scanning profile points at the credential used to collect from it.
Security and editing
- Secrets are encrypted at rest, and the credentials list shows only the name, type, and description — never a secret.
- The type can't be changed after a credential is created; create a new one if you need a different type.
- Editing lets you update details or replace a secret. An administrator opening the edit form also sees the stored secret, because the form is pre-filled with it — see below.
- Deleting a credential leaves any discovery configuration that used it without a linked credential, so update those afterwards.
Who can see a stored secret
Be clear about what encryption at rest does and doesn't protect you from here.
- Administrators can retrieve any stored secret. Opening a credential's edit form fetches the decrypted value to pre-fill the fields, so an admin can read back an SSH key, API token, or SNMP community in full.
- Everyone else cannot. Non-admins with access to the credentials module get the list only — names, types and descriptions, no secret values. The scanning and discovery pickers use that same names-only list.
- Retrieval is not recorded. Creating, changing and deleting a credential are written to the activity log; reading one is not, so there is no record of an admin having viewed a secret.
Treat organisation administrator as equivalent to holding every credential in the system, and grant it accordingly. If a secret needs to be unrecoverable even by an admin, JOATOS is not the right place to store it.
Notes & tips
- Give credentials clear names (e.g. Core switches SNMPv3, Linux SSH key) so the right one is easy to pick on a scanning profile.
- Store one credential per distinct login rather than sharing broadly — it's easier to rotate.