How to Create and Manage Client Credentials for Your Team

Beginner 15 minutes DevOps / Platform Engineers Getting Started

Create end-user, service-token, and AI-agent credentials, set expiry dates, authorize specific repositories, and rotate secrets.

Overview

Client credentials are how Chainsaw identifies who is requesting packages. Each credential maps to a Client ID and Secret pair, and can be scoped to specific repositories, given an expiry date, and assigned a client type. This tutorial covers the full lifecycle of credential management.

Prerequisites

  • A running Chainsaw instance with admin or owner access
  • At least one configured repository

Step 1: Navigate to the Access Page

Click Access in the sidebar navigation. This page shows all existing client credentials for your organization.

Access page showing client credentials
The Access page lists all client credentials with their status and type

Step 2: Create a New Credential

Click the Create Credential button.

Choose a Client Type

Chainsaw supports three client types:

TypeUse Case
End UserIndividual developers on their local machines
Service TokenCI/CD pipelines, build servers, automated systems
AI AgentAI coding assistants and automated dependency managers
Create credential form
Fill in the credential name and select the client type

Configure the Credential

  1. Name — A descriptive label (e.g., frontend-team, github-actions-prod)
  2. Client Type — Select from the dropdown
  3. Authorized Repositories — Choose which repositories this credential can access
  4. Expiry Date (optional) — Set an expiration for time-limited access
Use descriptive names that identify the team or pipeline. This makes it easy to trace activity in audit logs and the traffic view.

Step 3: Copy the Credentials

After creation, Chainsaw displays the Client ID and Client Secret. Copy both values immediately.

Newly created credential with ID and secret
Copy the Client ID and Secret — the secret won't be shown again
The Client Secret is only shown once at creation time. If you lose it, you’ll need to reset the secret (which generates a new one).

Step 4: Scope Repository Access

Each credential can be limited to specific repositories. This follows the principle of least privilege — a frontend team’s credential only needs access to the npm registry, not Maven or Docker.

  1. Click on a credential in the list
  2. Navigate to the Authorized Repositories section
  3. Select the repositories this credential should access
Repository scoping for a credential
Restrict a credential to only the repositories it needs

Step 5: Enable or Disable Credentials

You can temporarily disable a credential without deleting it. This is useful during incident response or when offboarding a team.

  1. Find the credential in the list
  2. Toggle the Enabled switch
Disabling a client credential
Disable a credential to immediately revoke access without deleting it

Step 6: Reset a Client Secret

If a secret is compromised or lost:

  1. Click on the credential
  2. Click Reset Secret
  3. Copy the new secret and distribute it to the affected team
Resetting a client secret
Generate a new secret — the old one is immediately invalidated
Resetting a secret immediately invalidates the old one. All systems using this credential will need to be updated.

Step 7: Set Expiry Dates

For temporary access (contractors, feature branches, time-limited projects):

  1. Edit the credential
  2. Set an Expiry Date
  3. The credential automatically stops working after this date
Setting an expiry date on a credential
Time-limited credentials automatically expire

Best Practices

  • One credential per team or pipeline — Don’t share credentials across unrelated systems
  • Use service tokens for CI/CD — These can be rotated independently of developer credentials
  • Set expiry dates for contractors — Avoid orphaned long-lived credentials
  • Scope to minimum repositories — Frontend teams don’t need Docker Hub access
  • Rotate secrets periodically — Reset secrets on a regular schedule (e.g., quarterly)

Viewing Credential Activity

To see what a specific credential has been downloading, navigate to the Traffic page and filter by Client ID.

Traffic filtered by client ID
Filter traffic logs by a specific client credential

Next Steps