# Credential onboarding

Do not put credential values in this file, Git, generated configuration, command arguments, terminal history, or logs.

1. Obtain written authorization for `<credential-purpose>`, `<consumer-inventory>`, `<approved-scope>`, and `<rotation-window>`.
2. Have the authorized operator enter `<credential-value>` only through the approved secure prompt or standard input boundary.
3. Store it only in the configured SOPS-encrypted operational-secrets file, then reseed and verify OpenBao before changing consumers.
4. Keep the previous credential active only for the approved overlap window; revoke it only after every consumer check succeeds.
5. Record `<credential-identifier>`, `<timestamp>`, `<operator>`, and `<status>` without recording any credential value.

See [docs/secrets.md](docs/secrets.md) and [docs/runbooks/credential-rotation.md](docs/runbooks/credential-rotation.md).