# Manage connection credentials

> Store write-only connection credentials in your system credential store, an encrypted local vault, or environment variables.

Renart keeps sensitive connection fields write-only. You can replace, rotate, or clear a credential, but Renart never returns its current value to the browser.

## Choose a credential source

Choose the source that matches how Renart runs:

| Source               | Best for                                                              | Availability                                                               |
| -------------------- | --------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| **Credential store** | Normal desktop use                                                    | Available through your operating system’s signed-in credential service     |
| **Encrypted vault**  | Interactive local or SSH sessions without a usable credential service | Available after you unlock it for the current Renart process               |
| **Environment**      | CI and unattended schedules                                           | Available when the variable exists in the environment of the Renart server |

All three sources keep the value out of the project files you commit. Renart stores only a symbolic, environment-scoped binding in the repository and never falls back to plaintext storage.

## Use the credential store

1. Open the project switcher and choose **Project settings**.
2. Open **Connections**, then add a connection or select an existing one.
3. Open **Credentials**. For each sensitive field, choose **Credential store**.
4. Enter the replacement value and save the connection.

The field changes to **Configured · Local** after Renart stores the value. Leave the input blank when editing later to keep the current credential.

If the credential service is locked, unlock it in your operating-system session and try again. If it is unavailable—common in some SSH sessions—use the encrypted vault or an environment binding instead.

## Use the encrypted vault

1. Open **Project settings → Connections**.
2. Choose **Encrypted vault** in the sidebar, then click **Set up**.
3. Enter and confirm a passphrase of at least 12 characters.
4. Add or edit a connection, open **Credentials**, choose **Encrypted vault** for a sensitive field, enter the replacement value, and save.

The vault is scoped to the current project. Its age-encrypted file lives in your user configuration directory, outside the Git repository. Setting it up unlocks it for the current Renart process; click **Lock** when you want to end that session manually.

After Renart restarts, return to **Connections → Encrypted vault** and click **Unlock** before inspecting, verifying, or running connections that use the vault.

> **Keep the passphrase recoverable**
>
> Renart cannot recover a forgotten vault passphrase. Keep the underlying service credentials recoverable through the service that issued them, and store the vault passphrase in a trusted password manager.

## Use an environment variable

Use an environment binding when another system already injects credentials, such as CI, a service manager, or a container runtime:

1. Make the variable available to the process that starts Renart.
2. In **Project settings → Connections**, add or edit the connection.
3. Open **Credentials** and choose **Environment** for the sensitive field.
4. Enter the variable name, such as `WAREHOUSE_PASSWORD`, not its value.
5. Save the connection.

Renart stores the variable name and resolves its value only when the connection is used. If the variable is missing, the connection remains unavailable until you restart or reconfigure Renart with that variable.

For unattended schedules, prefer this source over the encrypted vault. A server restart locks the vault, while a correctly configured service environment is available as soon as the server starts.

## Rotate, move, or clear a credential

Open the existing connection in **Project settings → Connections**, then expand **Credentials**:

- To rotate a credential, leave its source selected, enter the replacement, and save.
- To move a credential, choose another source, enter the replacement or environment-variable name, and save.
- To remove a configured credential, click **Clear**, then save.

Unlock the current vault before moving or clearing a vault-backed credential, so Renart can remove the old encrypted value as part of the change.

Click **Verify** before saving when you want to test the draft connection. Verification uses the replacement in memory without making the change persistent.

## Work from the terminal

The same write-only operations are available through `renart secrets`. Secret values are read from a hidden prompt or standard input, never from command-line arguments:

```bash
# Inspect safe status metadata.
renart secrets status --env production warehouse password

# Store a replacement in the operating-system credential store.
renart secrets set --env production warehouse password

# Store a replacement in the encrypted vault.
renart secrets set --env production --store vault warehouse password

# Bind the field to an existing environment variable.
renart secrets set --env production --from-env WAREHOUSE_PASSWORD warehouse password
```

Vault administration is also available from the terminal:

```bash
renart secrets vault status
renart secrets vault init
renart secrets vault unlock
renart secrets vault change-passphrase
renart secrets vault lock
```

`vault unlock`, `vault lock`, and `vault change-passphrase` manage the session inside a running Renart web or standalone process. Other CLI commands use an isolated session and prompt when they need to open the vault.

## Result

The connection editor shows the source and safe status for every sensitive field. Project files contain references rather than values, and connection operations resolve only the credentials they need.

## Related

- [Managing connections](https://getrenart.com/docs/connections-environments/managing-connections.md)
- [Scheduling](https://getrenart.com/docs/scheduling/overview.md)
- [CLI reference](https://getrenart.com/docs/reference/cli.md)
- [Security and privacy](https://getrenart.com/docs/reference/security-and-privacy.md)