Create one named credential for each script, dashboard or agent. Sign in to the sensor's website, open Integrations, and create it there. The secret is shown once; the sensor keeps only its hash. Copy it into a protected file or secret store straight away.
What a credential is limited to
| Setting | Range |
|---|---|
| Name | 1–64 characters |
| Scopes | Any of the eleven below. Default: health:read and results:read |
| Interfaces | Up to 32 named radios the credential may use |
| Networks | Up to 32 target networks for ping, trace and DNS |
| Expiry | 1–365 days, default 90 |
| Longest test | 1–900 seconds per job, default 900 |
Scopes
| Scope | What it allows |
|---|---|
health:read |
Health, capabilities and managed resource status |
results:read |
Sensor-wide result metadata, including network observations |
artifacts:read |
Download indexed capture and test files |
scan:run |
Finite scans on the interfaces you grant |
capture:run |
Finite captures on the interfaces you grant |
network:run |
Ping, trace and DNS within the target networks you grant |
radius:read |
RADIUS status, configuration, certificates, accounting, test catalogue and reports |
radius:test |
Run RADIUS tests, analyse captures and validate custom tests |
radius:control |
Start and stop the RADIUS service and act on sessions |
radius:write |
Change RADIUS users, clients, settings and custom tests, and manage the RADIUS test certificates |
radius:secrets |
Export identities and certificates with their keys, upload secret inputs and create enrolment profiles |
Grant only what the caller needs. Radio ownership and station protection apply to automated jobs exactly as they do to the app and the website. A credential can see and cancel its own jobs; the owner can manage all of them.
What no credential can do
Credentials cannot manage passwords, the sensor's own HTTPS certificate, Bluetooth pairing, firmware
or expert administration. Those stay with the signed-in owner. The RADIUS test certificates are
separate from the sensor's HTTPS certificate: radius:write can create, import and delete them.
Revoke and audit
Revoke a credential from Integrations at any time. Revocation or expiry cancels its pending work, and is checked again while an active test runs. The same page shows an audit log of what each credential did. A trusted LAN does not bypass any of these checks.