Credentials
Every key you hand to Rockslab, and every key Rockslab hands to you, in one list.
3 min Open Credentials ↗
On this page
What lives here
- Cloud keys — the Hetzner tokens behind your cloud accounts.
- DNS keys — what writes your zones (Cloudflare, Hetzner DNS).
- S3 keys — for buckets.
- Rockslab API — tokens for scripts, CI and agents, each acting as the person who minted it. See API tokens.
+ Credential adds one; pick the kind, fill in what it asks for.
What you never see again
A secret goes into the platform's vault the moment you save it. After that the list shows only what it is, where it is used and when it was last checked — never the value. If you lose a token, make a new one at the provider and replace it on the same credential; the things using it pick up the new value.
Scope
A credential can be limited to where it may be used: the whole organization, one account, or whatever carries a label. A DNS key scoped to env=dev cannot name a production cluster, even by accident.
Was this page useful? Updated Oct 22, 2026