Agent credentials

In Connections, choose the source type, enter its non-secret scope, select an agent, and choose a credential mode. For Local credential catalog, enter an uppercase credential name such as PILOT_SHARE. This name identifies an entry in the agent's local catalog; it is not an environment variable or a path supplied by the console.

Open Get started, step 4 and select your connection to get copyable examples with your exact credential name. Replace placeholders only on the agent host.

Secret file formats

The catalog is /run/secrets/myrikeep-credentials.json inside the container. For an SMB connection named PILOT_SHARE, its entry is:

{
  "version": 1,
  "credentials": {
    "PILOT_SHARE": {
      "type": "smb",
      "source": {"kind": "file_json", "path": "/run/secrets/PILOT_SHARE"}
    }
  }
}

Use the following fields in the separate credential JSON file. All values must be nonempty strings. Change the catalog type to match the connection.

For example, the file /run/secrets/PILOT_SHARE for SMB contains:

{"username": "<USERNAME>", "password": "<PASSWORD>", "domain": "<DOMAIN>"}

Omit domain if it is not required by your SMB server. Use read-only source permissions. For S3, scope permissions to the selected bucket and prefix; for Azure, scope access to the selected container; for IMAP, select the mail folders and use TLS. SMB connections need a host and share; S3 needs a bucket; Azure needs an account URL and container; IMAP needs a host.

Create the host directory /srv/myrikeep/secrets. Put the catalog and your credential file there, owned by root or the agent UID, with mode 0400 or 0600; make sure the agent UID can read them. No symlinked files or directories. Merge new entries into an existing catalog rather than replacing its entries. Add this flag to the generated docker run command, before the image name:

--mount type=bind,src=/srv/myrikeep/secrets,dst=/run/secrets,readonly

If the agent is already running with this directory mounted, adding the files does not require a restart. To add the mount itself, recreate the container with the same state volume. Wait for its next heartbeat; present means the agent resolved and validated the credential for the current connection revision. A stale, missing or older-revision report does not complete step 4. Presence does not guarantee the provider will accept the credentials; a failed scan still needs its reported source access problem resolved.

Other credential modes and connectors

For S3 or Azure workload identity, configure the identity on the agent host instead of creating secret files, leave the credential name empty, and wait for the agent's credential check. A Local mount needs no credential file, but its agent still reports readiness; see the local guide.

For Microsoft 365, use the M365 connector guide for app registration, read-only permissions, tenant consent and the exact secret JSON. For Gmail or Google Drive, use the Google Workspace guide for the downloaded service-account JSON and domain-wide delegation. The checklist supplies the catalog entry for your connection's credential name.

For personal Google Drive and OneDrive, the credential file holds your own app's client fields. Refresh tokens live in the writable state volume after sign-in. Follow Personal drives; app passwords cannot be used for Drive files. For provider permission setup, read the SMB, S3, Azure and IMAP guides.

File permissions and catalog rules

For example, after saving files in your host's secret directory:

sudo chown 10001:10001 /srv/myrikeep/secrets/myrikeep-credentials.json /srv/myrikeep/secrets/PILOT_SHARE
sudo chmod 0600 /srv/myrikeep/secrets/myrikeep-credentials.json /srv/myrikeep/secrets/PILOT_SHARE

Mode 0440 is also accepted when the agent belongs to the owning group. Files must be regular files, at most 64 KiB, with no symlinked files or directory components. Do not add unrelated fields or duplicate JSON keys. Use type for one connector, or types for a compatible Microsoft 365 or Workspace pair/group, never both. Do not share a catalog entry across unrelated connector families.

Credential names start with A–Z, then use A–Z, 0–9 or _, up to 64 characters. Names beginning DJANGO_, DG_, POSTGRES, REDIS, DATABASE or SECRET are reserved. The alias selects a catalog entry, not a host filename by convention. The catalog's file source determines the actual path. The catalog also supports {"kind": "env_json", "name": "SCAN_CREDENTIAL_JSON"} as an operator-configured source for JSON in an environment variable; aliases never select environment variables automatically. File JSON is the recommended walkthrough here.

Credential and pickup states

See Getting started for exclusions and schedules, and Security for processing and retention details.