# Transformation Credentials


The credential store is a central repository in the [RudderStack dashboard](https://app.rudderstack.com/) for securely storing and efficiently managing your configuration data.

{{< success >}}
By storing secrets and variables in RudderStack's credential store, you can avoid hardcoding sensitive information in your transformations and avoid any security risks.
{{< /success >}}

## Credentials overview

RudderStack supports two types of credentials - **Secrets** and **Variables**.

| Credential | <div style="width:250px">Description</div> | Examples | 
| :---| :----| :-----|
| [Secret](#create-secrets) | Lets you store sensitive information as encrypted text values and use them as environment variables in your [transformations]({{< ref "transformations/overview.md" >}}). <br /><br />Note that you **cannot** see the secrets in the dashboard after setting them. | Passwords, app secrets, API tokens. |
| [Variable](#create-variables) | Lets you store non-sensitive configuration data as non-encrypted strings. | Application configuration, paths. | 

## Access credential store

{{< info >}}
This tab is visible in the RudderStack [Growth and Enterprise](https://www.rudderstack.com/pricing/) plans only.
{{< /info >}}

Go to **Settings** > **Workspace** > **Credentials** to access the credential store and create your secrets and variables.

{{< image src="images/dashboard-guides/credential-store.webp" alt="RudderStack credential store" >}}

## Required permissions

- [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage secrets and variables in the credential store
- [Members]({{< ref "access-management/member-management.md#member-roles" >}}) must have the [**Credential Store**]({{< ref "access-management/policies-overview.md#resource-permissions" >}}) permission in their workspace policy

{{< details "**Click here to see how these permissions appear in the workspace policy**." >}}
<br />

{{< figure src="images/access-management/credential-store.webp" alt="Permissions to manage credential store in RudderStack dashboard" >}}

{{< /details >}}
<br />

#### Permissions for legacy RBAC system

In the [legacy Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md" >}}), only [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) and members with the [**Connections Admin** role]({{< ref "archive/dashboard-guides/user-management.md#connections" >}}) in their workspace policy can access and manage secrets and variables in the credential store.

{{< image src="images/access-management/tracking-plan-permissions-legacy-framework.webp" alt="Credential store permissions in the legacy framework" >}}

## Create secrets

1. Go to the **Secrets** tab of the credential store.
2. Click **New secret**.
3. Enter the secret name and value.

{{< warning >}}
Secret names can contain only alphanumeric characters and underscores and they cannot start with a number.
{{< /warning >}}

4. Click **Add** to save the secret.

{{< image src="images/features/transformations/credentials/create-secret.webp" alt="Create secret in credential store" >}}

To edit a secret, click the edit icon, enter the new secret value, and click **Save**. Note that the previous secret value will **not** be visible.

{{< image src="images/features/transformations/credentials/edit-secret.webp" alt="Edit secret in credential store" >}}

## Create variables

1. Go to the **Variables** tab of the credential store.
2. Click **New variable**.
3. Enter the variable name and value.

{{< warning >}}
Note the following:

- Variable names must contain only alphanumeric characters and underscores.
- They cannot start with a number.
- The name must not exceed 2048 characters.
{{< /warning >}}

4. Click **Add** to save the variable.

{{< image src="images/features/transformations/credentials/create-variable.webp" alt="Create secret in credential store" >}}

To edit a variable, click the edit icon, enter the new value, and click **Save**.

## Use credentials in transformations

Once you create the credentials in the credential store, you can reuse them by referencing them within the `getCredential()` function in your transformations. 

See [Runtime Functions in Transformations]({{< ref "transformations/runtime-functions.md#getCredential" >}}) for more information on using the `getCredential` function.

Note the following while using credentials in transformations:

- Any workspace member can use the credentials in their transformations.
- You **cannot** use credentials in [transformation libraries]({{< ref "transformations/libraries.md" >}}).
- `getCredential` is a restricted keyword in transformations. You must not use it for naming functions or variables.
- RudderStack drops the event in case of any error while [using the `getCredential` function]({{< ref "transformations/runtime-functions.md#getCredential" >}}) in a transformation that is connected to a destination.

{{< warning >}}
Do not log or embed secrets in the event payload from the transformation. 

All workspace users (including read-only users) have access to the transformation logs and live events and can get access to these secrets if you do not handle them properly in the transformation. 
{{< /warning >}}