Credentials

Credentials provide daemons with the authentication details they need to gather data during discovery. Without credentials, discovery is limited to port scanning and DNS lookups. With credentials configured, a daemon can also query devices for their details, interfaces and neighbors, connect to container APIs, or read a network controller's inventory.

Credential Types

Scanopy supports these credential types, grouped by the integration they enable. Each type can be pointed at one or more targets — see Where a credential applies.

Each integration's guide covers what the other side needs configured, which transport to choose, and how to verify it:

• Docker
• Instant On
• Podman
• Proxmox VE
• UniFi Controller
• Wake-on-LAN
• SNMP
• SSH
• gNMI

Creating a credential

Creating a credential works the same way for every integration:

1. Go to Platform > Credentials
2. Click Create Credential
3. Select the credential type — the transport, not just the integration (e.g. SNMP v2c, Docker Proxy, UniFi API Key)
4. Enter a name that will make sense later ("Core switches", "HQ controller")
5. Fill in the type's fields — each integration's guide lists them
6. Click Save

Secrets — community strings, passwords, API keys, private keys — are not shown again in the UI or in API responses once saved.

Default credentials

Every organization has three default credentials:

To stop using a default, unassign it from the site or remove it from the daemon's setup. Defaults can't be deleted, and a new credential identical to a default is rejected.

Daemon OS sets how file paths are checked

Password, key and certificate fields take their value in one of two ways. Enter value stores the value in Scanopy. File on daemon host stores a path, and the daemon reads the file at each scan. Docker Socket and Podman Socket credentials also name a path on the daemon host.

A credential that names a path on the daemon host has a Daemon OS: Linux, macOS, BSD or Windows. The form shows the choice once a field reads a file on the daemon host or a socket path is set. Scanopy checks each path against it when you save:

• The path is absolute for that OS, such as /etc/scanopy/key.pem or C:\ProgramData\Scanopy\key.pem.
• ~ is not expanded, because the daemon can run as a different user. Write the full path.

A daemon on a different OS skips the credential, and the run's Credentials tab shows the warning Credential set up for another OS with the credential's name. Set Daemon OS to the OS of the daemons that scan with the credential, or scan with a daemon on the OS the credential names. A credential that names no path on the daemon host works on a daemon of either OS.

Where a credential applies

Every credential is pointed at one or more targets, which determine the hosts the daemon tries it on:

Not every type supports every target — the Can be targeted at column above shows which. A protocol that any device can speak reaches a whole Site; a local socket reaches only its daemon host; a proxy or controller names the one host its endpoint lives on. An unsupported assignment is rejected on save, and changing a credential's type drops assignments the new type doesn't allow.

Attaching a credential

Where you attach a credential depends only on whether the host exists yet:

The first two name a target by IP, since the host isn't in Scanopy yet — see auto-assignment. An assignment made on a host can be narrowed to specific interfaces, which matters when a credential is reachable only one way in.

Credential Resolution

When the daemon scans a host, it resolves credentials in this priority order:

1. Host-level assignment — credentials assigned directly to the host (or its specific interface)
2. Site default — credentials targeted at the host's whole site

All available credentials at each level are tried — not just the first match. If every credential fails (timeout or authentication error), the host is scanned without that credential type's data.

Auto-Assignment

Naming a target by IP covers the gap between knowing a device's credentials and Scanopy having discovered it. The next scan tries the credential at that address; if it works, the credential is assigned to whatever host was found there. Until then it shows as unassigned — expected, not a failure.

The target is used once, and cleared when the scan ends whether or not it matched, so nothing is re-probed forever. A target covering a whole Site moves into that site's assignment rather than being dropped.

If auto-assignment isn't working, see Troubleshooting credentials.