credential-management-guidelisted

# Credential Management Guidelines Own the provider-neutral credential lifecycle. A provider guide still owns its token types, exact scopes, login command, request header, and verification probe. ## Essentials - **Avoid stored secrets when possible** - Prefer a native login cache for a person and a short-lived workload identity or federated credential for automation, see [references/credential-selection.md](references/credential-selection.md) - **Use one credential per integration** - Bind it to one non-human identity, environment, purpose, and minimum resource/operation scope - **Keep a single source of truth** - Store local credentials in the platform secret store and shared credentials in an approved secret manager, see [references/local-storage.md](references/local-storage.md) - **Resolve at the last responsible moment** - Read the value immediately before use, pass it through the provider-supported channel, and remove it from process state as soon as practical - **Treat environment variables as transport** - They may be appropriate for a process or CI step, but are not a durable secret store - **Design the full lifecycle** - Record owner, purpose, consumers, creation, expiry, rotation, revocation, audit source, and recovery before adoption - **Assume masking can fail** - Never print, transform for debugging, place in URLs, or enable shell tracing around a secret - **Revoke before cleanup** - On suspected exposure, invalidate the credential first; repository or log cle