Manage connection credentials

Renart keeps sensitive connection fields write-only. You can replace, rotate, or clear a credential, but Renart never returns its current value to the browser.

Choose a credential source

Choose the source that matches how Renart runs:

Source	Best for	Availability
Credential store	Normal desktop use	Available through your operating system’s signed-in credential service
Encrypted vault	Interactive local or SSH sessions without a usable credential service	Available after you unlock it for the current Renart process
Environment	CI and unattended schedules	Available when the variable exists in the environment of the Renart server

All three sources keep the value out of the project files you commit. Renart stores only a symbolic, environment-scoped binding in the repository and never falls back to plaintext storage.

Use the credential store

1. Open the project switcher and choose Project settings.
2. Open Connections, then add a connection or select an existing one.
3. Open Credentials. For each sensitive field, choose Credential store.
4. Enter the replacement value and save the connection.

The field changes to Configured · Local after Renart stores the value. Leave the input blank when editing later to keep the current credential.

If the credential service is locked, unlock it in your operating-system session and try again. If it is unavailable—common in some SSH sessions—use the encrypted vault or an environment binding instead.

Use the encrypted vault

1. Open Project settings → Connections.
2. Choose Encrypted vault in the sidebar, then click Set up.
3. Enter and confirm a passphrase of at least 12 characters.
4. Add or edit a connection, open Credentials, choose Encrypted vault for a sensitive field, enter the replacement value, and save.

The vault is scoped to the current project. Its age-encrypted file lives in your user configuration directory, outside the Git repository. Setting it up unlocks it for the current Renart process; click Lock when you want to end that session manually.

After Renart restarts, return to Connections → Encrypted vault and click Unlock before inspecting, verifying, or running connections that use the vault.

Keep the passphrase recoverable

Renart cannot recover a forgotten vault passphrase. Keep the underlying service credentials recoverable through the service that issued them, and store the vault passphrase in a trusted password manager.

Use an environment variable

Use an environment binding when another system already injects credentials, such as CI, a service manager, or a container runtime:

1. Make the variable available to the process that starts Renart.
2. In Project settings → Connections, add or edit the connection.
3. Open Credentials and choose Environment for the sensitive field.
4. Enter the variable name, such as WAREHOUSE_PASSWORD, not its value.
5. Save the connection.

Renart stores the variable name and resolves its value only when the connection is used. If the variable is missing, the connection remains unavailable until you restart or reconfigure Renart with that variable.

For unattended schedules, prefer this source over the encrypted vault. A server restart locks the vault, while a correctly configured service environment is available as soon as the server starts.

Rotate, move, or clear a credential

Open the existing connection in Project settings → Connections, then expand Credentials:

• To rotate a credential, leave its source selected, enter the replacement, and save.
• To move a credential, choose another source, enter the replacement or environment-variable name, and save.
• To remove a configured credential, click Clear, then save.

Unlock the current vault before moving or clearing a vault-backed credential, so Renart can remove the old encrypted value as part of the change.

Click Verify before saving when you want to test the draft connection. Verification uses the replacement in memory without making the change persistent.

Work from the terminal

The same write-only operations are available through renart secrets. Secret values are read from a hidden prompt or standard input, never from command-line arguments:

# Inspect safe status metadata.
renart secrets status --env production warehouse password

# Store a replacement in the operating-system credential store.
renart secrets set --env production warehouse password

# Store a replacement in the encrypted vault.
renart secrets set --env production --store vault warehouse password

# Bind the field to an existing environment variable.
renart secrets set --env production --from-env WAREHOUSE_PASSWORD warehouse password

Vault administration is also available from the terminal:

renart secrets vault status
renart secrets vault init
renart secrets vault unlock
renart secrets vault change-passphrase
renart secrets vault lock

vault unlock, vault lock, and vault change-passphrase manage the session inside a running Renart web or standalone process. Other CLI commands use an isolated session and prompt when they need to open the vault.

Result

The connection editor shows the source and safe status for every sensitive field. Project files contain references rather than values, and connection operations resolve only the credentials they need.

Related

• Managing connections
• Scheduling
• CLI reference
• Security and privacy