--- description: "Manage organization credentials and OAuth connections that give Fluid Attacks access to repositories to start security testing." keywords: "credentials, OAuth, HTTPS, SSH, Azure DevOps PAT, Cross account AWS IAM role, add credentials, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: Manage your credentials --- # Manage your credentials import { Image } from "@/components/image"; Fluid Attacks requires your organization to provide credentials to access the repositories to be tested. Alternatively, your organization can [allow access to repositories via Open Authorization](https://help.fluidattacks.com/portal/en/kb/articles/import-repositories-fast-and-safely-with-oauth) (OAuth), eliminating the need to provide credentials. Both actual credentials (e.g., username and password pairs) and connections made with OAuth are registered in the **Credentials** section on Fluid Attacks' platform. From there, you can also begin the connection via OAuth to the supported providers, which are GitHub, GitLab, Bitbucket, and Azure. ## View organization credentials table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Organization Manager The table in the **Credentials** section shows the credentials stored for use across the organization, meaning that they are accessible to all groups within the organization. Manage organization credentials on the Fluid Attacks platform

Manage organization credentials on the Fluid Attacks platform

The table provides the following information: - **Name:** The unique identifier for the credential. - **Owner:** The email of either the person who registered the credentials on the platform or the last person who edited them - **Status:** Whether credentials are associated with repositories under evaluation by Fluid Attacks and, if so, which repositories - **[Type](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Credential_type):** The authentication method, which can be one of the following: - **User and password:** The classic combination of username and password - **SSH:** A secure key used for accessing remote systems, similar to a password but more secure - **Access token:** A Personal Access Token used for authentication with Azure DevOps - **AWSROLE:** Allows Fluid Attacks to assume an Identity and Access Management (IAM) role in your AWS account - **OAUTH:** Used for delegated authorization to grant Fluid Attacks access to your repositories on supported providers (GitHub, GitLab, Bitbucket, and Azure) ## Add credentials > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Organization Manager If you wish to connect Fluid Attacks' platform with an account on a supported code repository hosting provider, refer to the instructions at [Import repositories fast and safely with OAuth](https://help.fluidattacks.com/portal/en/kb/articles/import-repositories-fast-and-safely-with-oauth). > [!NOTE] > > Ensure that the provider (Azure, GitLab, GitHub, or Bitbucket) allows third-party applications (like Fluid Attacks platform) to access your repositories via OAuth. If not going for OAuth this time, follow these steps to add new credentials to use across your organization: 1. Go to the **Credentials** section. 1. Click on **Add credentials**. 1. Choose **Add manually**. Add credentials on the Fluid Attacks platform

Add credentials on the Fluid Attacks platform

1. In the pop-up window, enter a unique credential name (shorter than 100 characters) and select the [credential type](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Credential_type). (Read below what extra steps to follow if you are choosing an AWS role.) Provide credentials details on the Fluid Attacks platform

Provide credentials details on the Fluid Attacks platform

1. Provide the relevant credentials and click on **Add**. The new credentials are then added to the table. View added credentials on the Fluid Attacks platform

View added credentials on the Fluid Attacks platform

In case you choose to grant Fluid Attacks access through cross-account IAM, you are asked for the Amazon Resource Name (ARN) of the role. Therefore, you need to follow these extra steps: 1. In the pop-up window, copy the external ID provided by Fluid Attacks. Get external ID for IAM role on the Fluid Attacks platform

Get external ID for IAM role on the Fluid Attacks platform

1. Create an IAM role including the external ID. To learn how to do this, [read the instructions](https://help.fluidattacks.com/portal/en/kb/articles/set-up-an-aws-iam-role). > [!TIP] > > **Note:** If your organization has multiple AWS accounts, you can create the IAM role in each account and provide the corresponding ARN when adding credentials. ## Edit credentials > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Organization Manager Do the following to edit existing credentials: 1. Go to the **Credentials** section. 1. Select the credentials and click on **Manage credentials**. Manage credentials on the Fluid Attacks platform

Manage credentials on the Fluid Attacks platform

1. Click on **Edit**. Edit credentials on the Fluid Attacks platform

1. In the pop-up window, make the desired changes and, if needed, turn on the toggle that says **New secrets** to enable editing them. Change credentials secrets on the Fluid Attacks platform

Change credentials secrets on the Fluid Attacks platform

1. Click **Edit** to apply the changes. > [!TIP] > > **Note:** If you edit credentials secrets, you are the new owner of the credentials in question. ## Remove credentials > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Organization Manager Bear in mind the following considerations about removing credentials: 1. Removing credentials also removes them from all associated [Git repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_Git_repositories). 1. Removing a member from the organization removes their credentials from the organization, and member removal is only possible if these are unused (if under use, you would have to replace in Scope first). These are the steps to delete credentials: 1. Access the Credentials section. 1. Select the credentials and click on **Manage credentials**. 1. Click on **Remove**. Remove credentials on the Fluid Attacks platform

Remove credentials on the Fluid Attacks platform

1. Confirm the removal in the warning window. Confirm credentials removal on the Fluid Attacks platform

If the credentials are in use, their deletion is prevented. In this case, you are told to navigate to the Scope section to change those credentials in the repositories that are using them. After this, you may go back to Credentials and retry the deletion. Get error when removing credentials on the Fluid Attacks platform

Get error when removing credentials on the Fluid Attacks platform

## Search the credentials table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Organization Manager You can filter the credentials table by using the search bar. You can search by the contents of **Name**, **Type**, and **Owner**. Just type what you are looking for and only the rows whose content match your search are shown. Search credentials on the Fluid Attacks platform

Search credentials on the Fluid Attacks platform

> [!TIP] > > **Free trial**Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).