> ## Documentation Index
> Fetch the complete documentation index at: https://docs.up.telestream.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Store and manage third-party service credentials used by other Telestream UP applications

## Overview

The Credentials page (internally called "Vault") is where admins store secrets — API keys, AWS keys, SSH keys, Iconik tokens, and similar — that other Telestream UP applications (Workflow, Scheduler, Capture, and so on) use to connect to external systems. Go to **Settings → Credentials**.

This page is admin-only / entitlement-gated: you'll only see the **Credentials** tab if your role or organization plan grants access.

## Viewing credentials

The table lists each credential's nickname, service (for example AWS, GitHub, Iconik — pick from the list or type your own), type, status (**Active**/**Deactivated**), whether it's scoped to individual users or a group, when it was last used, and who created it. Use the search box to find a credential by name, service, or type.

## Creating a credential

Click **Create Credential** and fill in:

* **Nickname** — 3–63 characters, letters/numbers/spaces/underscores/hyphens.
* **Service** — pick from the list or type your own.
* **Credential Type** — locked once the credential is created. Choose from: API Key, AWS IAM User, AWS Role, Access & Secret Keys, JSON, SSH, or Iconik. Each type shows its own secret fields below (for example, an SSH credential asks for a private key and optional passphrase; an Iconik credential asks for an Application ID and API Token).
* **User Type** — **Individual Users** or **Groups**, then pick who is allowed to use this credential.

Click **Create**. A confirmation toast appears once it's saved.

## Editing a credential

Click a row to open it for editing. By default, existing secret values are left untouched — turn on **Edit credential payload** if you need to replace the stored secret itself. You can always change the nickname, service, and who's allowed to use it without touching the secret.

## Activating, deactivating, and deleting

Use a row's menu (or select it and use the toolbar) to **Deactivate** an active credential or **Activate** a deactivated one — this takes effect immediately, no confirmation needed. **Delete** asks you to confirm first, since it can't be undone.

## When there's nothing here yet

If no credentials are registered, or your search doesn't match anything, the page shows "No credentials found."