Concepts - cred

## Keyboard shortcuts

Press `←` or `→` to navigate between chapters

Press `S` or `/` to search in the book

Press `?` to show this help

Press `Esc` to hide this help

# Concepts

cred is built around three core concepts that work together to manage your secrets.

## Vault

The vault is your local encrypted secrets store. Each project has its own vault at `.cred/vault.enc` containing all your secrets with metadata like format, timestamps, and descriptions.

Learn more about the Vault →

## Sources

Sources are platforms that can programmatically generate credentials. Instead of manually creating API keys, you can have cred generate them for you with the appropriate permissions.

Currently supported:

- Resend — Email API key generation

Learn more about Sources →

## Targets

Targets are platforms where you push secrets for deployment. cred uploads your vault secrets to these platforms so your workflows can access them directly.

Currently supported:

- GitHub — Actions secrets
- Vercel — Environment variables
- Fly.io — App secrets

Learn more about Targets →

## How They Work Together

    ┌─────────────┐     generate      ┌─────────────┐      push       ┌─────────────┐
    │   Source    │ ───────────────►  │    Vault    │ ──────────────► │   Target    │
    │  (Resend)   │                   │ (encrypted) │                 │  (GitHub)   │
    └─────────────┘                   └─────────────┘                 └─────────────┘
                                            ▲
                                            │ manual set
                                            │
                                      ┌─────────────┐
                                      │     You     │
                                      └─────────────┘

1. Sources generate credentials and store them in your vault
2. You can also manually add secrets to the vault
3. Targets receive secrets when you push from the vault