# Credentials and scopes

> Give each script or agent its own named sensor credential, limited by scope, radio, network, duration and expiry.

Create one named credential for each script, dashboard or agent. Sign in to the sensor's website,
open **Integrations**, and create it there. The secret is shown once; the sensor keeps only its hash.
Copy it into a protected file or secret store straight away.

## What a credential is limited to

| Setting | Range |
| --- | --- |
| Name | 1–64 characters |
| Scopes | Any of the eleven below. Default: `health:read` and `results:read` |
| Interfaces | Up to 32 named radios the credential may use |
| Networks | Up to 32 target networks for ping, trace and DNS |
| Expiry | 1–365 days, default 90 |
| Longest test | 1–900 seconds per job, default 900 |

## Scopes

| Scope | What it allows |
| --- | --- |
| `health:read` | Health, capabilities and managed resource status |
| `results:read` | Sensor-wide result metadata, including network observations |
| `artifacts:read` | Download indexed capture and test files |
| `scan:run` | Finite scans on the interfaces you grant |
| `capture:run` | Finite captures on the interfaces you grant |
| `network:run` | Ping, trace and DNS within the target networks you grant |
| `radius:read` | RADIUS status, configuration, certificates, accounting, test catalogue and reports |
| `radius:test` | Run RADIUS tests, analyse captures and validate custom tests |
| `radius:control` | Start and stop the RADIUS service and act on sessions |
| `radius:write` | Change RADIUS users, clients, settings and custom tests, and manage the RADIUS test certificates |
| `radius:secrets` | Export identities and certificates with their keys, upload secret inputs and create enrolment profiles |

Grant only what the caller needs. Radio ownership and station protection apply to automated jobs
exactly as they do to the app and the website. A credential can see and cancel its own jobs; the
owner can manage all of them.

## What no credential can do

Credentials cannot manage passwords, the sensor's own HTTPS certificate, Bluetooth pairing, firmware
or expert administration. Those stay with the signed-in owner. The RADIUS test certificates are
separate from the sensor's HTTPS certificate: `radius:write` can create, import and delete them.

## Revoke and audit

Revoke a credential from **Integrations** at any time. Revocation or expiry cancels its pending
work, and is checked again while an active test runs. The same page shows an audit log of what each
credential did. A trusted LAN does not bypass any of these checks.