> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thoras.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> How Thoras handles the credentials it needs, and how to supply your own.

Thoras needs a handful of credentials to run: an internal API token, the
dashboard login, and the bundled database password. You don't have to provide
any of them. On first install, Thoras generates whatever you didn't supply and
stores it in the `thoras-config-controller` Secret in the release namespace. If
a credential later changes, Thoras restarts the components that use it so you
don't have to.

<Note>
  On a fresh install, workload pods briefly report `CreateContainerConfigError`
  while Thoras performs its first reconcile. This clears on its own.
</Note>

## Supplying your own credentials

Each credential resolves in this order of precedence:

1. **A Secret you manage**, referenced via `*.existingSecret` or `*SecretRef*`
   values.
2. **A value pinned in `values.yaml`**.
3. **Generated by Thoras** into the `thoras-config-controller` Secret (default).

For example, to point the internal API token at your own Secret:

```yaml theme={null}
apiClientSecret:
  existingSecret:
    secretName: my-thoras-api-client
    secretKey: api-client-secret
```

The Helm chart README lists every credential and the values keys that back it.
See
[Secrets](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#secrets)
for the full table.

## Rotating a credential

Generated values are not intended to be rotated in place. To control rotation,
take ownership of the value by pinning it in `values.yaml` or by pointing the
chart at a Secret you manage.

* **Existing Secret:** update the value in your Secret. Thoras picks up the
  change within about a minute.
* **Pinned value:** change it in `values.yaml` and run `helm upgrade`.

Two caveats:

* Rotating the dashboard cookie secret signs every active dashboard session out.
* The bundled TimescaleDB password has no rotation path. Use
  [external TimescaleDB](/installation/persistent-storage#external-timescaledb-byodb)
  if you need to rotate the database password.

For the exact rotation semantics under GitOps, see
[Rotating secrets](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#rotating-secrets)
in the chart README.

## Legacy secret seeding

`featureFlags.enableLegacySecretSeeding` (default `true`) keeps rendering the
chart 4.x `api-client-secret` and `thoras-timescale-password` Secrets so their
values can be migrated on upgrade. Nothing consumes them afterwards.

* **Fresh installs:** set it to `false`.
* **Upgrading from 4.x:** leave it on for the upgrade, then set it to `false`
  once the pods are healthy.
* **GitOps and `helm template`:** set it to `false`. The legacy Secrets use Helm
  `lookup`, which those workflows cannot evaluate.

The flag and the legacy Secrets are removed in chart 6.0. See
[Deprecations](/deprecations).

## Further reading

* Chart README:
  [Secrets](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#secrets),
  [Rotating secrets](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#rotating-secrets),
  and
  [Thoras Config Controller values](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#thoras-config-controller).
* [Default (htpasswd) dashboard auth](/guides/dashboard-auth/htpasswd)
* [ArgoCD](/guides/argo-cd)