Credential Management
Permission: All logged-in users.
This page explains where and how the credentials KIOPS uses (SSH access info, image registries, Docker Hub, source repository tokens, DB connections, and more) are stored and where you manage them. There is no central "View / Import / Export Credentials" screen — it was removed once all credentials moved to the server-side encrypted store.
What you can do here
- Storage method: All credentials (SSH passwords/private keys, registry and Docker Hub auth, Git PATs, DB passwords, etc.) are stored in the KIOPS server's encrypted store using AES-256-GCM, and that store is the single source of truth.
- No browser storage, auto-injection: No plaintext is stored in the browser. Only the first-time value is sent to and encrypted on the server; for later operations against the same target (deploy, system info collection, resource lookups, etc.) the server injects the stored value automatically. So it applies as-is when you log in from another PC/browser, and clearing browser data does not lose it (changed from the previous localStorage approach).
- Per-organization isolation: Credentials are stored isolated per organization and are not shared across organizations.
- Masking: Once stored, credentials are masked; each screen only shows the storage status (Saved / Not registered) and plaintext is never displayed again.
Key elements
Instead of a central viewer, each credential is entered and edited on the domain screen that actually uses it, with a status indicator confirming whether it is saved.
| Credential | Where to manage | Where to check status |
|---|---|---|
| SSH access info (password/private key) | [Device Management] → Access credentials in device edit | Device list / edit screen |
| Source repository token (GitLab/GitHub PAT) | [Service Management] → Service settings (Source) | Service's source-completion status |
| Image registry / Docker Hub | [Service Management] → Service / Security settings | Service's registry-auth status |
| DB password / tunnel SSH | [Database Management] → Add/edit connection | Connection list / connection test |
- SSH authentication method: Both password and SSH key authentication are supported, switched via a toggle in the input modal. In multi-hop connections, each hop can use a different authentication method.
Related tasks
- Enter / re-enter: A value you enter for the first time on any screen is stored encrypted on the server and reused automatically for later operations against the same target (build, deploy, system info collection, resource lookups, backups, DB tests, etc.). If you saved the wrong value or need to change it, re-enter it at the management location above and the server's stored value is updated. The import/export feature that exported plaintext credentials to JSON was removed because of the exposure risk.
- Related: Runtime Environments · Device Management · VPN Management