> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-paul-querna-mcp-sources-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up credential stores

> Securely manage and distribute the initial passwords for application accounts provisioned through C1.

## How are credential stores used in C1?

When you use C1 to provision new application accounts through connectors that support [automatic account provisioning](/product/admin/account-provisioning), these new accounts are often created with a starter password. Credential stores provide a secure location to collect these initial passwords. This allows credential store owners to easily distribute them to the owners of the new accounts, whether through email, Slack, or your preferred communication method.

For added convenience, the new account password is also included in the entry for the new account on the user's **Requests** page. The account recipient can always decrypt their own password. Credential store owners can decrypt passwords on behalf of other users.

## Set up a new credential store

<Warning>
  This task requires the **Super Administrator** role in C1.
</Warning>

<Steps>
  <Step>
    Navigate to **Vaults** > **Provisioned credentials** and click **Add credential store**.
  </Step>

  <Step>
    Give the new credential store a name and description.
  </Step>

  <Step>
    Choose who can access the credentials:

    * **Owners** limits access to the credential store's owners and each credential's account recipient.
    * **Anyone with the link** allows anyone who has the credential link to access it.
  </Step>

  <Step>
    Add one or more **Owners**. Store owners can view and decrypt all credentials in the credential store. Super admins can create credential stores, but cannot decrypt passwords for others unless they are also an owner.
  </Step>

  <Step>
    Click **Save**.
  </Step>
</Steps>

**Done.** The new credential store is added to the **Provisioned credentials** page.

### Set the default password expiration

If needed, you can set the length of time newly created passwords will last before they expire.

<Steps>
  <Step>
    On a credential store's details page, click the settings icon (it looks like a gear).
  </Step>

  <Step>
    Use the dropdown to select how long passwords created in this credential store will last. Preset options range from one hour to one year. Choose **Custom** to select a password duration if your preferred length isn't on the list.
  </Step>

  <Step>
    Click **Save**.
  </Step>
</Steps>

**Done.** New passwords created in this credential store will expire after the timeframe you set elapses.

## Configure a connector to save new account passwords to a credential store

<Steps>
  <Step>
    Navigate to the **Apps** page.
  </Step>

  <Step>
    On the **Managed apps** tab, locate and click on the application you want to configure.
  </Step>

  <Step>
    On the app's **Overview** page, locate the **Accounts management** section. Click **Edit** next to **Provisioning**. The provisioning configuration drawer opens.
  </Step>

  <Step>
    Select **Connector** from the dropdown, then select the connector for this app. The **Mappings** panel is shown. (See the [automatic account provisioning](/product/admin/account-provisioning) docs for more on configuring the connector, if you haven't already done so.)
  </Step>

  <Step>
    In the **Password storage** area of the page, select **Save to credential store** and select the credential store you want to use.
  </Step>

  <Step>
    Click **Save**.
  </Step>
</Steps>

**Done.** Now when a user requests a new account in this app, the new account's password will be saved to the credential store you specified and included on the **Accounts** tab on the user's **Requests** page. The account recipient and credential store owners can decrypt the new account password.