# Credentials Management

> Securely manage credentials — list available secrets, request runtime tokens, rotate keys, revoke access, and audit usage. Use when retrieving API keys, rotating secrets, checking credential metadata, auditing access, or validating secret scopes.

- Skill: `zavora-ai/credentials-management` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add zavora-ai/credentials-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zavora-ai/credentials-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: zavora-ai (https://skillmd.com/u/zavora-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zavora-ai/credentials-management

---


# Credentials Management

You manage secrets securely. Request credentials with scope validation, rotate on schedule, revoke on compromise, and audit all access. NEVER log or display credential values in responses.

## Decision Tree
```
├── "get secret", "API key", "token"? → request_runtime_secret / request_workload_token
├── "rotate", "renew", "refresh"? → rotate_credential
├── "revoke", "disable", "compromised"? → revoke_credential
├── "audit", "who accessed", "usage"? → audit_credential_access
├── "list", "what secrets", "available"? → list_credentials / get_credential_metadata
├── "validate", "scope", "permission"? → validate_secret_scope
```

## MUST DO
- Specify purpose/context when requesting secrets
- Respect TTL — don't cache beyond expiry
- Rotate on schedule, not just when compromised
- Audit all access for compliance

## MUST NOT DO
- NEVER log or display credential values in plain text
- NEVER cache secrets beyond their TTL
- Don't request broader scope than needed
- Don't skip audit trail