Create manage-credentials.mdx

docs.json

@@ -62,6 +62,7 @@
               "get-started/connect-to-runpod",
               "get-started/concepts",
               "get-started/api-keys",
+              "get-started/manage-credentials",
               "get-started/agent-skills",
               "get-started/mcp-servers",
               "get-started/early-access"

get-started/manage-credentials.mdx

@@ -0,0 +1,182 @@
+---
+title: "Manage credentials"
+sidebarTitle: "Credentials"
+description: "Create and manage your API keys, SSH keys, S3 API keys, container registry credentials, and secrets from the Credentials page."
+---
+
+All Runpod credentials live in one place: the [Credentials page](https://www.console.runpod.io/user/credentials) in the console. The page has five tabs, one for each credential type.
+
+| Credential | What it's for |
+|---|---|
+| **API keys** | Authenticate requests to the Runpod API, CLI, and SDKs. |
+| **S3 API keys** | Access network volumes using S3-compatible tools. |
+| **SSH public keys** | Connect to Pods over SSH from your local machine. |
+| **Container Registry Auth** | Pull private container images when creating a Pod or template. |
+| **Secrets** | Store sensitive values to inject into Pods without exposing them in plain text. |
+
+Setting up your credentials before your first deployment will save you time. API keys and SSH keys in particular are required before you can interact with Runpod programmatically or connect to a running Pod.
+
+---
+
+## API keys
+
+API keys authenticate your identity when making requests to Runpod. You'll need one any time you interact with Runpod outside the web console, for example when using the Runpod CLI, the Python SDK, or making direct REST or GraphQL API calls.
+
+Runpod API keys support three permission levels, which let you limit what a key can do. This is useful if you want to give a key to a script or external tool without granting it full control over your account.
+
+<Note>
+  Legacy API keys generated before November 11, 2024 have either Read/Write or Read Only access to GraphQL based on what was set for that key. All legacy keys have full access to the AI API. To improve security, generate a new key with **Restricted** permission and select the minimum access needed for your use case.
+</Note>
+
+### Create an API key
+
+1. Go to the [Credentials page](https://www.console.runpod.io/user/credentials) and select the **API Keys** tab.
+2. Select **+ Create API Key**.
+3. Give your key a name and set its permissions:
+   - **All**: Full access to all Runpod APIs. Use this for personal scripts or trusted tools.
+   - **Restricted**: Customize access per Serverless endpoint. For each endpoint, choose one of the following:
+     - **None**: No access.
+     - **Read/Write**: Full access.
+     - **Read Only**: Read access without write access.
+   - **Read Only**: Read access across all APIs without the ability to create, modify, or delete resources. Useful for monitoring or observability integrations.
+4. Select **Create**, then select the key to copy it to your clipboard.
+
+<Warning>
+  Runpod does not store your API key after creation. Save it somewhere safe, for example in your password manager or as a GitHub Actions secret. Treat it like a password: never share it or commit it to a public repository.
+</Warning>
+
+### Edit API key permissions
+
+You can change a key's permissions at any time without regenerating it.
+
+1. On the **API Keys** tab, select the pencil icon next to the key you want to update.
+2. Update the permissions and select **Update**.
+
+### Enable or disable an API key
+
+Disabling a key temporarily blocks all requests authenticated with it, without deleting it. This is useful if you suspect a key has been compromised but aren't ready to revoke it permanently.
+
+On the **API Keys** tab, select the toggle for the key, then confirm in the dialog.
+
+### Delete an API key
+
+Deleting a key is permanent. Any integration or script using it will immediately lose access.
+
+On the **API Keys** tab, select the trash icon for the key, then select **Revoke Key** to confirm.
+
+---
+
+## S3 API keys
+
+S3 API keys give you access to your [network volumes](/storage/network-volumes) through any S3-compatible tool, such as the AWS CLI, `boto3`, or `rclone`. This lets you upload, download, and manage files on your network volumes directly from your local machine, without needing to start a Pod first.
+
+S3 API keys are separate from your Runpod API keys because they use the AWS S3 authentication format. Tools that speak S3 expect a specific credential structure (an access key ID and a secret), so Runpod issues a dedicated key type for this purpose.
+
+### Create an S3 API key
+
+1. Go to the [Credentials page](https://www.console.runpod.io/user/credentials) and select the **S3 API Keys** tab.
+2. Select **Create an S3 API key**, give it a name, and select **Create**.
+3. Save the **access key** (e.g., `user_***...`) and **secret** (e.g., `rps_***...`). You'll enter these into your S3 tool of choice during setup.
+
+<Warning>
+  Runpod shows your S3 key secret only once. Copy and save it before closing the dialog — you cannot retrieve it afterward.
+</Warning>
+
+For full setup and usage instructions, including AWS CLI configuration and code examples, see [S3-compatible API](/storage/s3-api).
+
+---
+
+## SSH public keys
+
+SSH public key authentication lets you connect to a Pod from your local terminal using a secure key pair instead of a password. It is the recommended connection method because it is more secure, does not require you to remember a password, and can be automated.
+
+You generate a key pair on your local machine. The private key stays on your machine, and you share the public key with Runpod. When you start a Pod, Runpod injects your public key into it. When you connect, your SSH client uses your private key to prove your identity without ever sending a password over the network.
+
+### Generate an SSH key pair
+
+If you don't already have an SSH key, run this command in your local terminal, replacing the email address with your own:
+
+```sh
+ssh-keygen -t ed25519 -C "YOUR_EMAIL@DOMAIN.COM"
+```
+
+This creates two files:
+
+- `~/.ssh/id_ed25519`: Your private key. Keep this on your machine and never share it.
+- `~/.ssh/id_ed25519.pub`: Your public key. This is what you add to Runpod.
+
+<Warning>
+  If you're using Windows Command Prompt instead of WSL or a Linux terminal, the keys are saved to `C:\Users\YOUR_USER_ACCOUNT\.ssh\` instead.
+</Warning>
+
+### Add your SSH public key to Runpod
+
+1. Run `cat ~/.ssh/id_ed25519.pub` to print your public key to the terminal.
+2. Copy the output in full. It starts with `ssh-ed25519` and ends with your email.
+3. Go to the [Credentials page](https://www.console.runpod.io/user/credentials) and select the **SSH Public Keys** tab.
+4. Paste the key and save.
+
+<Warning>
+  If you add multiple SSH keys, place each key on its own line. Pasting the key fingerprint (which starts with `SHA256:`) instead of the public key itself is a common mistake and will cause authentication to fail.
+</Warning>
+
+Once saved, your key is automatically injected into every Pod you start. For full connection instructions, see [Connect to a Pod with SSH](/pods/configuration/use-ssh).
+
+---
+
+## Container Registry Auth
+
+By default, Runpod can pull any public container image when starting a Pod or creating a template. If your image is hosted in a private registry, you need to add a registry credential so Runpod has permission to pull it. Private registries include Docker Hub private repositories, GitHub Container Registry, and AWS ECR.
+
+Once added, the credential appears as a selectable option in the dropdown when you create or edit a template.
+
+### Add a container registry credential
+
+1. Go to the [Credentials page](https://www.console.runpod.io/user/credentials) and select the **Container Registry Auth** tab.
+2. Select **+ Add credential**.
+3. Give the credential a name you'll recognize, select the registry type, and enter your registry username and password or access token.
+4. Select **Save**.
+
+You can add multiple credentials for different registries, and edit or remove them at any time using the pencil and trash icons in the credential list.
+
+---
+
+## Secrets
+
+Secrets are encrypted key-value pairs for storing sensitive information that your Pods and Serverless workers need at runtime: API tokens, database passwords, model access tokens, and service credentials.
+
+The key difference between a secret and a regular environment variable is that a secret's value is encrypted at rest and never displayed in plain text after creation. You reference it in your template configuration by name, and Runpod substitutes the actual value when the Pod starts:
+
+```text
+{{ RUNPOD_SECRET_secret_name }}
+```
+
+For example, if you're running a model that requires a Hugging Face token, you'd store the token as a secret named `huggingface_token` and reference it in your template like this:
+
+```text
+HF_TOKEN={{ RUNPOD_SECRET_huggingface_token }}
+```
+
+The token never appears in your template, your Pod logs, or anywhere visible in the console.
+
+### Create a secret
+
+1. Go to the [Credentials page](https://www.console.runpod.io/user/credentials) and select the **Secrets** tab.
+2. Select **+ Create secret**.
+3. Enter a name (e.g., `openai_api_key`), the secret value, and an optional description.
+4. Select **Create Secret**.
+
+<Note>
+  Once a secret is created, its value cannot be viewed again through the console. If you need to change it, edit the secret to set a new value.
+</Note>
+
+For full usage instructions, including how to reference secrets in templates and best practices, see [Manage secrets](/pods/templates/secrets).
+
+---
+
+## Next steps
+
+- [Connect to a Pod with SSH](/pods/configuration/use-ssh): Use your SSH key to access a running Pod from your terminal.
+- [S3-compatible API](/storage/s3-api): Configure your S3 API key and start transferring files to and from network volumes.
+- [Manage secrets](/pods/templates/secrets): Learn how to reference secrets in templates and follow security best practices.
+- [Create a custom template](/pods/templates/create-custom-template): Use your container registry credential when building a template from a private image.