Proof of identity or access
A workplace badge helps show who is entering a building. In a digital service, a credential serves a similar purpose. A person might sign in with a password or passkey; an app might use an API key when contacting another service.
Some credentials must be kept secret, including passwords, private API keys, and access tokens. An access token may provide temporary access after sign-in. A digital certificate can be shared, but its matching private key stays hidden. Authentication checks the proof; authorisation decides what the person or service may do.
Protect private credentials
Keep private credentials out of code, screenshots, and logs. Give each one only the access it needs, and revoke or replace it if exposed. Multi-factor authentication can help protect personal accounts. If someone asks for “the credentials”, check which account they mean and how to share them safely.