# Credentials

> Phase 2.1 · design: [design-phase-2.1-credentials.md](design-phase-2.1-credentials.md)

A **credential is a pure named secret** — `{ name, secret, scope }`. It
authenticates Harness Nexus *out to* an upstream MCP server or LLM gateway.
(It is not a personal access token; PATs authenticate *into* Harness Nexus.)

## Key properties

- **Encrypted at rest** — AES-256-GCM (`CREDENTIAL_ENCRYPTION_KEY`, falling
  back to `JWT_SECRET`). The API never returns the plaintext; responses carry
  a masked `secretPreview` only. Decryption happens solely at resolve time.
- **Referenced by placeholder, not bindings** — write `${cred:NAME}` anywhere
  in a transport string field (url, command, args, env values, header values)
  and the resolver substitutes it at the right moment:
  - server-dialed MCP rows: at connect time, server-side;
  - client-dialed rows: at config-fetch time, inside the shim's memory only.
- **Distributable flag** — personal credentials are always distributable; a
  global credential is distributable only if an admin opts in. Distributable
  credentials may be shipped to a user's machine for client-dialed
  connections and provider config push; locked globals stay server-only.

## Scope rules

Same as everything else: `global` = readable by all authenticated users,
admin-only to mutate; `personal` = owner-only. See
[Authentication](authentication.md#scoping).