> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery/doppler-credentials.md).

# Doppler: Credentials

### Overview

BalkanID supports discovery and governance of credentials within Doppler as part of **IGA for Non-Human Identities (NHI)**.

All credentials are normalized into the BalkanID data model and surfaced in the Credentials tab, along with their associated identities, access relationships, and risk insights.

The associated credentials can also be seen under the specific application integration (Doppler) page.

{% hint style="info" %}
Doppler credential discovery uses the same Service Account Token configured during Doppler Integration Setup. BalkanID never requests or stores secret **values** — only secret names, metadata, and access relationships are extracted.
{% endhint %}

### Credential Types Supported

{% hint style="info" %}
Note: The credential types listed below are examples and do not represent the complete set of supported Doppler credentials.
{% endhint %}

* Secrets (project / environment / config-scoped key-value entries)
* Config Service Tokens
* Service Account Tokens

### Common risks associated with Doppler Credentials include:

* **Stale Secrets:** Secrets that have not been rotated in 90+ days, increasing exposure if compromised.
* **Critically Old Secrets:** Secrets left unchanged for 180+ days without rotation.
* **Expired Tokens Retained:** Service tokens or service account tokens past their expiration date that remain associated with a project or service account, reducing visibility into active access.

This provides visibility into programmatic access across Doppler and strengthens Identity Governance and Administration (IGA) by enabling credential inventory, access analysis, lifecycle monitoring, and governance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery/doppler-credentials.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.