← Schema index / Config Reference
credentials schema
Canonical generated docsThis section is generated from
caco config schema --json. The table below preserves the runtime field path, type, required/default markers, and canonical description for every value in this slice.named credential wrappers resolved to a decrypted secret at call time (e.g. a Google service-account JSON for mobile app-store sources). Keyed by wrapper name; only the source descriptor lives here, never the secret.
| Field path | Type | Required | Default | Canonical description |
|---|---|---|---|---|
credentials | section | optional | named credential wrappers resolved to a decrypted secret at call time (e.g. a Google service-account JSON for mobile app-store sources). Keyed by wrapper name; only the source descriptor lives here, never the secret. | |
└ credentials.<wrapper-name> | map | optional | Credential wrapper entry. | |
└ credentials.<wrapper-name>.kind | string | required | Credential source kind. Currently only sops. | |
└ credentials.<wrapper-name>.path | string | optional | Path to the SOPS-encrypted file (kind=sops); repo-relative or absolute. | |
└ credentials.<wrapper-name>.field | string | optional | Field to extract from the decrypted SOPS document (kind=sops). | |
└ credentials.<wrapper-name>.age_key_from | string | optional | Age key source: an SSH key path (via ssh-to-age) or an age key file. Omit to use ambient SOPS_AGE_KEY_FILE / sops default. | |
└ credentials.<wrapper-name>.label | string | optional | Optional human-readable label for status/diagnostics. |