availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Using secrets in scans

Invicti Platform lets you use named secrets as credentials in scan authentication, so the actual credential value never appears in a target configuration. You reference a secret by name - Invicti Platform injects the current value at scan time.

This document explains how to use secrets with Simple form authentication, Login Sequence Recorder authentication, and OAuth 2.0 authentication.

Why this matters

Referencing secrets instead of entering credentials directly means that when a credential changes - whether it's a form login password, an LSR credential, or an OAuth 2.0 client secret - you update it once in Invicti Platform (or in your connected vault), and every scan configuration using that secret picks up the change automatically. Credentials aren't duplicated across targets, and access stays controlled at the secret level.

How secret references work

When you assign a secret to a credential field, the field stores the secret name in {{secretName}} format rather than the actual value. At scan time, Invicti Platform resolves the reference and injects the current credential value into the scan. Invicti Platform never stores the actual credential value in the target configuration or displays it after saving.

Secrets can come from two sources:

• Invicti Platform secrets - credentials stored directly in Invicti Platform. Refer to the Secrets document to add and manage these.
• Vault-sourced secrets - credentials retrieved at scan time from a connected secret manager. Refer to the HashiCorp Vault integration document to connect a vault and add vault-sourced secrets.

Both types are referenced in the same way once added.

Use secrets with Simple form authentication

Simple form authentication supports secret references in the Username and Password fields.

1. Select Inventory > Targets from the left-side menu.
2. Open the target you want to configure and click Edit.
3. Open the Authentication tab and set Authentication method to Simple form.
4. Click the key icon in the Username or Password field to open the secret picker.
5. Select the secret you want to use. The field shows the secret name in {{secretName}} format.
6. Click Save target configuration.

note

For a full walkthrough of Simple form authentication, refer to the Simple form authentication document.

Use secrets with Login Sequence Recorder authentication

Login Sequence Recorder (LSR) secrets work differently from other authentication methods. Instead of clicking a key icon on individual fields, you bind secrets to the target first, then reference them by name in the login sequence recording.

1. Select Inventory > Targets from the left-side menu.
2. Open the target you want to configure and click Edit target.
3. Select Authentication from the target settings sidebar and set Authentication method to Login sequence recorder.
4. In the Secrets used in the Login Sequence section, search for and select each secret the sequence needs. Each selected secret appears as a {{secretName}} chip.
5. Select Save target configuration.
6. In the login sequence recording, use {{secretName}} placeholders in change actions or script actions wherever a credential is needed.

For the full recording walkthrough, including how to insert secrets during recording and how to update an existing sequence, refer to Login sequence with secrets.

Use secrets with OAuth 2.0 authentication

OAuth 2.0 authentication supports secret references in the Access token URL, Client ID, Client secret, and Scope fields. If the grant type is Password Credentials, the Username and Password fields also support secrets.

1. Select Inventory > Targets from the left-side menu.
2. Open the target you want to configure and click Edit target.
3. Select Authentication from the target settings sidebar and set Authentication method to OAuth 2.0.
4. Click the key icon next to the credential field you want to cover with a secret.
5. Select the secret from the list. The field shows the secret name in {{secretName}} format.
6. Repeat for any other credential fields you want to cover with secrets.
7. Click Save target configuration.

note

For a full walkthrough of OAuth 2.0 authentication, including grant type options, refer to the Configure OAuth 2.0 authentication document.

Troubleshooting

A credential field shows a validation error after I select a secret

This happens when the secret was deleted or renamed after the target was last saved. Click the key icon to open the picker and select a valid secret, or enter the credential value directly. To avoid this, update secret values in place under Scans > Secrets rather than deleting and recreating them.

A secret doesn't appear in the picker

The picker only shows secrets you have permission to use. If a secret was created with restricted availability (Only me, Specific teams, or Specific users), ask the owner to grant access or change the availability setting in Scans > Secrets.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center