C is for Credentials - Are Your Secrets Really Secret?

After discussing Authentication and Biometrics, it’s time to look at the most fragile element of digital identity: credentials.

Today, credentials form the foundation of access to systems, applications, and infrastructure. Passwords, tokens, API keys, and certificates act as digital “secrets” that open doors to organizational resources.

The problem begins when those secrets stop being secret. And in practice, this happens far more often than most organizations would like to admit.

What Exactly Are Credentials?

Credentials are any type of data or mechanism used to confirm the right to access a system, service, or resource.

They may include:

• passwords
• API keys
• certificates
• access tokens
• SSH keys
• application secrets

Each of these elements provides the ability to authenticate or authorize access. And once a credential is exposed, access can be compromised instantly.

Why Is This Such a Big Problem?

Traditional security assumes credentials are:

• secret
• static
• controlled

Reality looks very different. In modern IT environments, credentials are often:

• hard coded directly into application code
• stored in scripts and CI/CD pipelines
• shared between teams
• reused across multiple systems
• stored in documents, spreadsheets, or chat applications

As a result, organizations lose visibility into who actually has access to critical resources.

The Uncomfortable Truth

Many modern security incidents do not begin with sophisticated “hacking” of infrastructure. They begin with leaked credentials. Compromised tokens, exposed API keys found in Git repositories, breached service accounts, and reused passwords remain some of the most common causes of security breaches. Attackers are increasingly less likely to “break” security controls. Far more often, they simply use legitimate credentials.

Main Types of Credentials

User Credentials

These are credentials used directly by people to gain access to systems. The most common examples include:

• passwords and passphrases
• passkeys compliant with FIDO2/WebAuthn
• recovery codes

It is important to note that solutions such as TOTP applications or physical security keys are considered authentication factors rather than traditional human credentials.

Application and Machine Credentials

This is currently one of the most critical areas of cybersecurity. In modern environments, the number of non human identities often exceeds the number of actual users.

This category includes:

• API keys
• OAuth/OIDC client secrets
• private keys and certificates used in mTLS
• signing keys
• SSH keys

It is worth remembering that a service account itself is not a credential. It is an identity. The credential is the key, certificate, or token used by that identity.

Temporary Credentials

Short lived credentials are becoming increasingly important. Examples include:

• OAuth access tokens
• refresh tokens
• session cookies
• session IDs
• SAML assertions
• JWT tokens

Their primary advantage is reducing the risk associated with long term usage of a single secret. Even if a token is compromised, its usefulness is limited by time.

The Biggest Challenge: Visibility and Rotation

For many organizations, the biggest issue is not the credential leak itself. The real problem is not knowing where credentials actually exist. You cannot protect what you cannot see. Unused accounts, expired certificates, excessive permissions, and forgotten tokens become silent entry points for attackers. That is why modern Identity Security focuses on several key principles:

• short lived secrets and regular rotation
• vault based credential storage
• least privilege by default
• continuous monitoring and full auditability

Credentials Should Never Be “Set and Forget”

One of the biggest mistakes organizations make is treating credentials as something configured once and forgotten. In reality, every secret will eventually leak.

The question is not “if”. It is “when”.

That is why modern security is not only about hiding secrets, but about building systems resilient to credential compromise. Because credentials are not identity. They are only proof of access.