> For the complete documentation index, see [llms.txt](https://docs.thousandeyes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thousandeyes.com/product-documentation/browser-synthetics/transaction-tests/getting-started/working-with-secure-credentials.md).

# Working With Secure Credentials

{% hint style="warning" %}
Due to recent platform-wide naming, navigation, and URL changes in the product, you might notice some discrepancies between the product and the screenshots displayed in our technical documentation. The instructions and actual pages in the product are still valid and haven’t changed. We are updating our screenshots to better match the in-product experience. See the full scope of changes on [Naming and Navigation Menu changes - Summary List](https://docs.thousandeyes.com/whats-new/naming-and-nav-phase-2-changes).
{% endhint %}

Transaction script workflows often include authentication in order to connect to secure resources such as shared folders or similar. To facilitate these scenarios in your ThousandEyes transaction tests, you can store and access login credentials, while keeping secure strings, such as passwords, hidden. With the right permission settings, you can even allow users create or update credentials, without actually being able to view the credential values themselves.

## Managing Credentials in the Credentials Repository

To manage login credentials, go to **Network & App Synthetics > Test Settings > Credentials Repository** tab.

![](/files/-MFaDm49d9D03EuNDACK)

* To add a credential, click **Add New Credential** (1).
* To delete a credential, hover over it in the list and click the trash icon (2). Then confirm that you want to delete this credential.
* To edit a credential, click its row in the list.

{% hint style="info" %}
The credentials you list here are available for use in transaction tests within the current account group, and do not extend to the entire organization that the account group is part of.
{% endhint %}

{% hint style="info" %}
To view saved credentials, your account must have the *View sensitive data in web transaction scripts* permission. However, if you lack this permission, you can still update the credential. For general information on account permissions, see [Working with Account Settings](https://docs.thousandeyes.com/product-documentation/user-management/authorization/account-groups/working-with-account-settings).
{% endhint %}

## Using Credentials in a Transaction Test

To use credentials from your ThousandEyes credentials repository in a transaction test, you must first enable them in the test's settings.

To enable the credentials, go to **Network & App Synthetics > Test Settings > Tests** tab. Open the transaction test in which you’d like to use this credential. Click the key icon and check the box next to your credential to enable it, as shown below:

![](/files/-MFaDm4G4QnAwnM7UU48)

In your transaction script, credential entries are accessed with the function `credentials.get('credentialName')`. For example, you can use this within a `typeText()` function like so:

`await typeText(credentials.get('myPassword'), By.id('passwordId'));`

## Disallowing Access to the Credentials Repository

You can disallow all users, regardless of their permissions, from accessing transaction test credentials after they have been entered into the credentials repository. By default, users with the **Organization Admin** or **Account Admin** roles can access credentials. Users with custom role definitions may also be able to do so. However, if you choose to disable credential retrieval entirely, that setting overrides any other permissions that are active for each user role.

![](/files/G7NX5X8boAhuKztFDmZz)

To disallow user credential access via the Web or API, users with the *Edit security & authentication settings* permission (i.e., the **Organization Admin** user role) can navigate to **Manage > Account Settings > Organization Settings > Security and Authentication > Credentials Repository** and toggle **Disable global credential retrieval** to override the *View sensitive data in web transaction scripts* permission setting.

Additional notes:

* This isn’t just obfuscating the password value. If you check this setting, the entire Credentials Repository tab will be inactive for all users. Users will still be able to select the credential from the Test Configuration tab on the Test Settings window when creating a transaction test, but they won’t be able to view the list, and they won’t be able to use the ThousandEyes API to retrieve credentials, either.
* This action also prevents ThousandEyes support personnel from accessing user credentials.
* Changes to the **Disable global credential retrieval** setting are logged under **Manage > Account Settings > Activity Log**.

{% hint style="info" %}
Unlike all the other permissions, the **Disable global credential retrieval** setting is under Organization Settings rather than Users and Roles. If you don’t have permission to edit this setting, the Organization Setting screen displays this setting as *Credential retrieval* and isn’t editable.
{% endhint %}

## Best Practices

Keep in mind the following guidelines when you use credentials in your transaction tests:

* Create a dummy user with minimal permissions, dedicated only to transaction tests. This avoids potential interference caused by simultaneous logins.
* Give each credential entry a descriptive name for easy recognition, rather than just a credential name like "test" or "testUser". This means that you’ll have to create the credential on the target system with the same descriptive name as you’d like your test credential to have. Even if the number of users editing transactions tests is small, having clear, organized credentials can be key to preserving clarity in your scripts. Note that the username doubles as the credential name.
* For added security, consider also saving username strings to the credentials repository.

## User Authentication Methods for Transaction Tests

The ever-changing array of authentication protocols, techniques, and practices that are currently in use can be broadly classified into “something you know” like a password, “something you have” like a mobile phone, and “something you are” (biometric retina scan, voice recognition). ThousandEyes transaction tests support some of these user authentication mechanisms, including some forms of two-factor authentication (2FA), multi-factor authentication (MFA), and single sign-on (SSO).

* Password
* PIN
* Challenge response
* Software tokens via app, SMS, or email

ThousandEyes currently doesn’t support authentication that relies on physical hardware tokens, push notifications, or biometrics directly within a transaction test script.

For sample scripts illustrating different user-authentication methods, see the [ThousandEyes Transaction Scripting Examples](https://github.com/thousandeyes/transaction-scripting-examples/tree/master/examples) public-facing repository on GitHub.

If you have further questions about how to adapt transaction tests for the authentication mechanisms that you already have in place, contact support as described in [Getting Support from ThousandEyes](https://docs.thousandeyes.com/product-documentation/getting-started/getting-support-from-thousandeyes).

## Additional Information

This section contains additional information on the use of credentials in ThousandEyes transaction tests.

If you have further questions on the use of secure user credentials in ThousandEyes transaction tests, contact ThousandEyes support as described in [Getting Support from ThousandEyes](https://docs.thousandeyes.com/product-documentation/getting-started/getting-support-from-thousandeyes).

### Permissions Related to Viewing Credentials in Transaction Tests

The following permission settings apply to transaction tests:

* *Create web transaction tests*. If you want to create a new transaction test, you must have this permission.
* *Edit tests*. If you want to edit a previously created test of any type, you need separate permissions for that.
* *View sensitive data in web transaction scripts*. Even if you can’t create transaction tests yourself, or even edit tests, you might have the ability to peek at the password for verification purposes if this permission is set. Thus, a user can create and save a test without being able to view the credential value itself.
* An additional setting can be used to disable anyone from retrieving saved credentials. See [Disallowing Access to the Credentials Repository](#disallowing-access-to-the-credentials-repository) on this page.

If you have permission to create tests, you’ll see a button titled **Add New Test** on the **Network & App Synthetics > Test Settings** window.

### Password Obfuscation

On the ThousandEyes platform, the password portion of the credential is obfuscated on the **Credentials Repository** tab. Only users with special permissions can open a credential list item, and even then, they’ll have to click the eye icon inside the credential text box in order to view the password in plain text.

![](/files/NivpIP2zqn4w6JkFVJBi)

{% hint style="warning" %}
If you use the Google Chrome Recorder to record a transaction test with a password or other secure credentials, the JSON file might contain that data in plain text.

We strongly recommend that, if any passwords were used in the recording, you use the credential repository option to store and replace them within the script. See [Using Credentials in a Transaction Test](#using-credentials-in-a-transaction-test) elsewhere on this page.
{% endhint %}

### Credential Naming

When you import a Google Chrome Recorder JSON file, ThousandEyes does not automatically create a credential in the Credentials Repository. Create the credential in the ThousandEyes platform, give it a clear name, and then replace the plain-text value in the script with a `credentials.get()` reference that uses that name.

Add the `credentials` module to the script import from `thousandeyes`. For example, use `import { driver, test, credentials } from 'thousandeyes';`.