A service credential is a password, token, or cryptographic key that software, a device, or an automated process uses to prove its identity to another system. Unlike a person’s login, it is often used without direct human interaction-for example, when an application connects to a database or a firewall management tool accesses another service.
These credentials matter because anyone who obtains a valid one may be able to authenticate as the associated service, subject to its permissions. They can appear in configuration exports, scripts, backups, or support files, sometimes in readable form. In an attack, a stolen or reused credential may enable unauthorized access or help an intruder move between systems. Defenses include storing secrets in a managed vault, limiting permissions, avoiding reuse, restricting access to diagnostic files, and rotating credentials if exposure is suspected.