availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Using secrets in scans

Invicti Platform lets you use named secrets as credentials in scan authentication, so the actual credential value never appears in a target configuration. You reference a secret by name - Invicti Platform injects the current value at scan time.

This document explains how to use secrets across the supported scan authentication methods.

Why this matters

Referencing secrets instead of entering credentials directly means that when a password changes, you update it once in Invicti Platform (or in your connected vault), and every scan configuration using that secret picks up the change automatically. Credentials aren't duplicated across targets, and access stays controlled at the secret level.

How secret references work

When you assign a secret to a credential field, the field stores the secret name in {{secretName}} format rather than the actual value. At scan time, Invicti Platform resolves the reference and injects the current credential value into the scan. The value is never stored in the target configuration or displayed after saving.

Secrets can come from two sources:

• Invicti Platform secrets - credentials stored directly in Invicti Platform. Refer to the Secrets document to add and manage these.
• Vault-sourced secrets - credentials retrieved at scan time from a connected secret manager. Refer to the HashiCorp Vault integration document to connect a vault and add vault-sourced secrets.

Both types are referenced in the same way once added.

Use secrets with Simple form authentication

Simple form authentication supports secret references in the Username and Password fields.

1. Select Inventory > Targets from the left-side menu.
2. Open the target you want to configure and click Edit.
3. Open the Authentication tab and set Authentication method to Simple form.
4. Click the key icon in the Username or Password field to open the secret picker.
5. Select the secret you want to use. The field shows the secret name in {{secretName}} format.
6. Click Save target configuration.

note

For a full walkthrough of Simple form authentication, refer to the Simple form authentication document.

Use secrets with Login Sequence Recorder authentication

When a target uses a Login Sequence Recorder (LSR) login sequence, you can bind secrets to the target so the LSR uses them during recording and scanning.

For the full setup, refer to the Login sequence with secrets document.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center