> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery.md).

# Credentials discovery

With BalkanID, organizations can discover, inventory, and govern credentials across all connected applications as part of **IGA for Non-Human Identities (NHI)**. Credentials include access keys, API keys, service account keys, SSH keys, and other non-human access mechanisms.

Credentials Discovery is the first step in governance. It enables teams to identify where credentials exist, who or what they are associated with, and what level of access they provide.

All discovered credentials are consolidated into a centralized **Credentials tab**, providing visibility into credential usage, ownership, and risk posture.

### **Viewing Credentials**

Users, Risk Managers, and IT Administrators can navigate to the **Credentials tab** from the navigation bar to view all credentials extracted across applications.

Each credential record represents a unique credential and includes metadata, associated identity, usage details, and risk insights.

<div data-with-frame="true"><figure><img src="https://2975852473-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVGYwk8aSk5yI1GDPEW9%2Fuploads%2F7TTxPKbBHi2TZrLoEqX6%2FCredentials_Gitbook.png?alt=media&#x26;token=114f473d-4403-4a25-a9e1-1ae194d1af4b" alt=""><figcaption></figcaption></figure></div>

### **Source vs. External Credentials**

Some credentials are generated and stored by the source application itself. Others live in an external vault or secrets manager instead — for example, a secret stored in Doppler or 1Password rather than issued directly by the connected application.

The Credentials tab includes an **All / Source / External** toggle so you can focus on one or the other:

* **All** — every credential, regardless of where it's stored.
* **Source** — credentials generated and stored by the source system itself.
* **External** — credentials stored in an external vault or secrets manager.

Credentials stored externally show a key icon and an **External** label next to their name, both in the table and on the credential's detail page. Hover the label for a description of what it means.

This toggle is also available on an application's or agent's **Credentials** tab, so you can filter to source or external credentials for that specific app or agent.

### **Credential Fields**

The Credentials tab displays the following fields for each credential:

| **Field**                                         | **Description**                                                                                |
| ------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| **Credential**                                    | Name of the credential along with its source identifier (e.g., access key ID, API key ID)      |
| **Type**                                          | Type of credential (e.g., access key, API key, service account key, SSH key, OAuth credential) |
| **Associated Identity**                           | The identity that the credential is linked to                                                  |
| **Application**                                   | The integrated application or cloud provider where the credential exists                       |
| **Status**                                        | Current state of the credential (e.g., active, inactive)                                       |
| [**Insights**](#credential-insights-risk-signals) | Risk signals and security findings associated with the credential                              |
| **Created / Last Rotated**                        | Timestamp indicating when the credential was created or last rotated                           |
| **Created By**                                    | The identity that created the credential, where known                                          |
| **Last Used**                                     | Timestamp indicating when the credential was last used (if available)                          |
| **Updated At**                                    | Timestamp indicating when the credential was last updated at the source                        |
| **Last Updated By**                               | The identity that last updated the credential, where known                                     |

Columns shown by default vary depending on whether the **All**, **Source**, or **External** view is selected, but any column can be added or removed from the table's column settings.

#### **Credential Insights (Risk Signals)**

BalkanID automatically evaluates credentials and generates insights to highlight potential security risks.

These insights help identify misconfigurations, stale credentials, and excessive access.

Common insights include:

* **Active credential for inactive identity**\
  Indicates that the parent identity is inactive, but the credential is still active. This presents a critical security risk.
* **Credential extremely old (>180 days)**\
  Credentials that have not been rotated for extended periods are more likely to be compromised.
* **Credential not rotated (>90 days)**\
  Indicates that the credential does not meet recommended rotation policies.
* **Credential unused (>90 days)**\
  Credentials that have not been used recently may be unnecessary and should be reviewed or deactivated.
* **Multiple active credentials**\
  Indicates that an identity has multiple active credentials, increasing the attack surface.

Each insight is accompanied by recommended remediation actions.

<div data-with-frame="true"><figure><img src="https://2975852473-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVGYwk8aSk5yI1GDPEW9%2Fuploads%2FRZKe5bYEV6RnQDmoLPHO%2FScreenshot%202026-03-30%20at%201.18.22%E2%80%AFPM.png?alt=media&#x26;token=bc8ca3ad-99d2-4ae2-ab80-3214a3111bdf" alt=""><figcaption></figcaption></figure></div>

### **Filtering and Investigation**

Users can filter credentials based on multiple parameters such as:

* Last used date
* Creation or rotation timelines, including when a credential was last updated at the source
* Insight type (risk category)
* Application or identity
* Whether a credential was created or last updated by a specific identity
* Whether a credential is source-generated or stored externally, using the **All / Source / External** toggle

This allows teams to quickly identify and prioritize high-risk credentials for remediation.

### **Credential Access and Blast Radius**

Each credential has a detailed view that shows the **resources and connections it has access to**.

This includes:

* Roles and permissions granted
* Resources accessible via the credential
* The full chain of access from credential to resource

This helps teams understand the **blast radius** of a credential in case of compromise.

Identities can be remapped if incorrectly classified to ensure accurate governance.

<div data-with-frame="true"><figure><img src="https://2975852473-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVGYwk8aSk5yI1GDPEW9%2Fuploads%2FPV1cDI1IOfYREj73633R%2FScreenshot%202026-03-30%20at%201.24.54%E2%80%AFPM.png?alt=media&#x26;token=8c816452-f12f-482d-977f-e5f73c99067a" alt=""><figcaption></figcaption></figure></div>

### **Identity vs Non-Identity Credentials - Planes of Access**

Credentials operate across different access planes:

* **Identity Credentials**
  * Example: Service account keys, HMAC keys
  * Inherit IAM permissions from the associated identity
* **Non-Identity Credentials**
  * Example: API keys, SSH keys
  * Provide direct or scoped access to services or resources

For example:

* A **service account key** can modify infrastructure (via IAM roles)
* A **SSH key** can directly log into a VM (system-level access)

Understanding this distinction is critical for accurate risk assessment.

Credentials Discovery enables organizations to:

* Gain visibility into all credentials
* Identify and remediate risks
* Understand access and blast radius
* Extend governance to non-human identities

This forms the foundation for NHI Identity Governance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.