---
title: "Documentation and credentials"
description: "Keep client documentation and shared credentials where the people who need them can find them, and nobody else can."
url: "https://support.outpostplatform.com/guides/documentation-and-vault/"
product: "depot"
type: "how-to"
status: "stub"
ai_summary: "Guide to Outpost documentation and the credential vault. Covers writing and organising client documentation, linking it to endpoints and clients, storing credentials encrypted with an explicit reveal step, controlling who can read what, and the audit trail on every reveal."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/guides/documentation-and-vault.md"
license: "CC BY 4.0"
---

# Documentation and credentials

The password for a client's firewall should not live in somebody's notes
application, and the runbook for their backup should not live in one
technician's head. Outpost keeps both next to the client and the endpoints they
belong to, with credentials encrypted and every reveal recorded. This guide is
for the technicians who write and read them.

<!-- TODO: write this page against the how-to template.

Sections:

- Before you begin: the documentation and credential permissions, which are
  separate on purpose.
- Writing a document, and organising documentation so it is found later.
- Linking a document to a client, a site or an endpoint.
- Storing a credential, and what is encrypted.
- Revealing a credential: the explicit step, and why there is no bulk export.
- Who can read what, and how access is scoped.
- The audit trail: what is recorded on every read and every reveal.
- Rotating a credential, and keeping the history.
- Getting documentation in from wherever it is now.
- If something goes wrong: a credential nobody can reveal, and a document
  attached to the wrong client.
-->

Follow the [how-to template](https://gitlab.com/outpostplatform/docs/-/blob/main/templates/how-to.md).