Skip to main content
When your application runs in production, there is no human to log in. Credentials let your services prove their identity to Enkryptify and retrieve secrets automatically. Enkryptify supports two types of machine credentials. Choose the one that fits your use case:

API Tokens

Static tokens for CI/CD pipelines, scripts and any environment where you need a simple Bearer token. Tokens have a fixed expiration and can be rotated or revoked at any time.

Kubernetes (OIDC)

Zero-secret authentication for Kubernetes workloads. Your pods prove their identity using short-lived tokens issued by the cluster. No static credentials stored anywhere.

​
How it works

Both credential types follow the same pattern:
  1. You register a credential in Enkryptify (with a name, permission and scope)
  2. Your application presents the credential to the Enkryptify API
  3. Enkryptify validates it and returns a short-lived JWT (15 minutes)
  4. Your application uses the JWT to read or write secrets
The credential itself never grants direct access to secrets. It is always exchanged for a scoped, time-limited JWT first.

​
Which one should I use?

API TokenKubernetes (OIDC)
Best forCI/CD, scripts, non-Kubernetes serversKubernetes pods
Credential lifetimeDays to months (you choose)~1 hour (auto-rotated by Kubernetes)
Stored as a secretYes (you store the ek_live_* token)No (generated dynamically)
Blast radius if leakedValid until expiration or revocationValid for ~1 hour max
Setup complexityCopy-paste a tokenConfigure a service account + projected volume
Rule of thumb: if your workload runs on Kubernetes, use OIDC. For everything else, use an API token.

​
Permissions and scope

Both credential types support the same permission and scope model:
  • Permission controls what the credential can do: Read only or Read & Write
  • Scope controls what the credential can access: the entire workspace, or specific teams, projects and environments
A credential can never exceed the permissions or scope of the user who created it. Members (read-only role) can only create read-only credentials. See Roles and permissions and Scoped access for details.

​
Managing credentials

All credentials are managed from the Credentials page in the dashboard sidebar. Both API tokens and Kubernetes identities appear in a single table, sorted by creation date. From the table you can:
  • See who created each credential and when it was last used
  • Revoke any credential immediately (the underlying JWT becomes invalid within 15 minutes)
  • Rotate API tokens (generates a new token value with the same settings)