Credentials

Synth credentials are organization resources. Store a credential once, then reference it from any Project, watcher, remote Git backend, ingestion flow, or provider configuration that supports its type.

Credentials are never attached or assigned to individual Projects.

Personal And Global

Scope	Who can see and select it	Who can edit or delete it
Personal	Its owner and administrators	Its owner and administrators
Global	Every authenticated user	Administrators

Use a Personal credential for a token that belongs to you. Use a Global credential for a service account or team token that everyone should be able to select.

Secret values remain server-side. Credential lists, component cards, logs, and API responses expose safe metadata rather than the stored secret.

Create A Personal Credential

1. Open Settings → Credentials.
2. Select New Credential.
3. Choose the credential type, give it a recognizable name, and enter its values.
4. Save it.

You can now select that credential while configuring any Project you can edit. Other non-admin users do not see it in credential lists.

Create A Global Credential

Administrators can:

1. Open Global Settings → Credentials.
2. Select New Credential.
3. Choose the type, name, and values.
4. Save it.

The credential immediately becomes selectable by every user in every Project. There is no Project assignment step.

Existing Components

A watcher or remote backend may already reference a Personal credential owned by another user. Collaborators can see a restricted reference so they can understand how the component is configured, but they cannot see the secret or select that credential for a new component. The existing component continues to run.

Deleting any credential can interrupt every component that references its ID. Review existing provider, watcher, ingestion, and remote-backend configuration before deletion.

CaSC And Helm

Credentials imported through Configuration-as-Code are always Global. With the Helm chart, define them under synth.credentials and load secret values from Kubernetes Secret environment variables:

synth:
  credentials:
    github-read-token:
      type: github_pat
      name: GitHub read token
      data:
        token:
          env: GITHUB_PAT

Projects and components reference only the credential ID:

projects:
  team-docs:
    watchers:
      docs:
        type: git
        repo: https://github.com/example/private-docs
        credential: github-read-token

Keep the token itself in a Kubernetes Secret, not in Helm values or CaSC.