Skip to Content
ModulesClients & EngagementsClient credentials

Client credentials

Keep a client’s logins (a registrar, a hosting account, a social media account) in that client’s own vault instead of a spreadsheet or a chat thread.

Who this is for: admins and owners in an org with Client Manager enabled. Other roles see the list of credentials but none of the actions.

Where it is

Open Clients, then a client. The client page has a Credentials card.

The card only works once the client has a vault. Until then it says “No vault provisioned for this client yet”, and its buttons are unavailable.

What CartonCrew stores, and what it does not

The username, password, login URL and optional 2FA seed go straight to the client’s vault as one secret. CartonCrew keeps only the description: provider, label, and whether the provider offers delegated access. The secret values are never stored, logged or cached by CartonCrew.

Capturing a credential

  1. On the Credentials card, click Capture credential.
  2. Fill in:
    • Provider and Label (both required), for example the service name and “Registrar account”
    • Login URL
    • Username and Password (both required)
    • TOTP seed (optional): the setup key the provider shows when you turn on two-factor authentication
    • The provider offers delegated / team access: tick this if the provider lets you add your own login to the client’s account. The form then suggests doing that instead of storing a shared password.
    • Notes (never secret)
  3. Click Store in vault.

Rotating a password

Click Rotate on the credential, enter the New password (and any other changes), then click Rotate credential. The vault keeps the old version as history.

Reveal and 2FA codes

  1. Click Reveal on the credential. CartonCrew reads the values from the vault at that moment. They are not cached.
  2. Each value is masked. Use Show to read it and Copy to copy it.
  3. If a TOTP seed was captured, click Get 2FA code for the current 6-digit code. It shows how many seconds it has left. The seed itself never leaves the server.

A credential flagged as having delegated access carries a reminder to move to a delegated login and retire the shared password.

The access log

The bottom of the reveal window shows the Access log for that credential: who did what and when. Capture, changes, reveals, 2FA codes and copies are all recorded, and so are attempts that were refused. The log never holds the values themselves.

Common issues

  • Capture credential is grayed out. The client’s vault is not provisioned, or it cannot be reached right now. The card shows which.
  • No Reveal button. Reveal is for admins and owners only.

Last updated: 2026-09-23 · Applies to: CartonCrew v1.643+

The engagement flowOverview