A valid credential is a login token, API key, password, certificate, or other secret that a system accepts as proof of identity. Once the credential is recognized, the caller is authenticated and can be treated as a known principal.
In cyber security, validity does not mean safety. Attackers often steal or replay valid credentials through phishing, token theft, session hijacking, or leaked keys, then use them to access systems without breaking authentication. This is especially risky in AI agent environments, where a legitimate token may let the agent reach tools or admin functions beyond its task. Defenses include least privilege, short-lived tokens, strong revocation, and action-level policy checks that verify each request, not just the login.