---
title: "Credential Management"
description: "Nexus OS provides secure credential management for API keys, tokens, and secrets. Credentials are stored encrypted in the Nexus database and injected at runtime: Credentials can be scoped to specific agents: Agents can o"
resource: https://www.aiagents.nexus/docs/manual/security/credentials
generated: { by: "process:nexus-agent-assets", at: 2026-09-07T09:13:03Z }
status: stable
---

# Credential Management

Nexus OS provides secure credential management for API keys, tokens, and secrets.

## How Credentials Work

Credentials are stored encrypted in the Nexus database and injected at runtime:

```bash
# Store a credential
naos secret set OPENAI_API_KEY sk-...

# List stored credentials (values hidden)
naos secret list

# Remove a credential
naos secret delete OPENAI_API_KEY
```

## Credential Scoping

Credentials can be scoped to specific agents:

```yaml
agents:
  planner:
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
  coder:
    secrets:
      - GITHUB_TOKEN
```

Agents can only access secrets explicitly assigned to them.

## Encryption

All credentials are encrypted at rest using AES-256-GCM. The encryption key is derived from:

1. A master key stored in the project's `.nexus/` directory
2. A per-credential salt
3. PBKDF2 key derivation with 100,000 iterations

## Best Practices

- **Never hardcode secrets** in agent source code
- **Rotate credentials** regularly using `naos secret set`
- **Use scoped credentials** — only give agents the secrets they need
- **Audit access** — check `naos audit` for credential usage patterns