Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

credentials

package module

Go to main page

Versions in this module

v0

v0.3.1

Oct 16, 2026

v0.3.0

Oct 2, 2026

v0.2.2

Sep 24, 2026

v0.2.1

Sep 24, 2026

v0.2.0

Aug 14, 2026

Changes in this version

+ const FailureAuthExpired

+ const FailureAuthRejected

+ const FailureAuthRevoked

+ const FailureExpired

+ const FailureRejected

+ const FailureRevoked

+ const FindingMissing

+ const FindingOrphan

+ const MaxDescriptorFieldLength

+ const MaxDescriptorIdentifierLength

+ const MaxDescriptorLength

+ const MaxGenerationLength

+ const MaxReferenceComponentLength

+ const MaxReferenceLength

+ const RecordSchemaV1

+ const ScopeDistributed

+ const ScopeHost

+ const ScopeProcess

+ const SharingScopeDistributed

+ const SharingScopeHost

+ const SharingScopeProcess

+ var ErrBuilderDependency = errors.New("credentials: builder dependency unavailable")

+ var ErrBuilderRecord = errors.New("credentials: invalid builder record")

+ var ErrCanceled = errors.New("credentials: operation canceled")

+ var ErrCatalogCanceled = errors.New("credentials: catalog operation canceled")

+ var ErrCatalogConflict = errors.New("credentials: catalog conflict")

+ var ErrCatalogCorrupt = errors.New("credentials: corrupt catalog")

+ var ErrCatalogDuplicate = ErrCatalogConflict

+ var ErrCatalogDurabilityUnknown = errors.New("credentials: catalog visible commit durability unknown")

+ var ErrCatalogInsecurePath = ErrCatalogCorrupt

+ var ErrCatalogInvalidDependency = errors.New("credentials: invalid catalog dependency")

+ var ErrCatalogInvalidRecord = errors.New("credentials: invalid catalog record")

+ var ErrCatalogNotFound = errors.New("credentials: catalog record not found")

+ var ErrCatalogUnavailable = errors.New("credentials: catalog unavailable")

+ var ErrCatalogUnknownSchema = ErrCatalogCorrupt

+ var ErrCatalogUnsupported = errors.New("credentials: catalog unsupported platform")

+ var ErrCatalogUnsupportedPlatform = ErrCatalogUnsupported

+ var ErrCatalogVisibleDurabilityUnknown = ErrCatalogDurabilityUnknown

+ var ErrClosed = ErrSourceClosed

+ var ErrFactoryConstruction = errors.New("credentials: credential factory construction failed")

+ var ErrFactoryMismatch = errors.New("credentials: credential factory identity mismatch")

+ var ErrFactoryUnsupported = errors.New("credentials: no exact credential factory")

+ var ErrInvalidDescriptor = errors.New("credentials: invalid descriptor")

+ var ErrInvalidFailure = errors.New("credentials: invalid failure")

+ var ErrInvalidGeneration = errors.New("credentials: invalid generation")

+ var ErrInvalidRecord = errors.New("credentials: invalid record")

+ var ErrInvalidReference = errors.New("credentials: invalid reference")

+ var ErrInvalidScheme = errors.New("credentials: invalid scheme")

+ var ErrInvalidUsage = errors.New("credentials: invalid usage class")

+ var ErrNilContext = errors.New("credentials: nil context")

+ var ErrOrphanState = errors.New("credentials: orphan secret state")

+ var ErrRefreshScope = errors.New("credentials: refresh coordinator scope too weak")

+ var ErrSourceClosed = errors.New("credentials: source closed")

+ var ErrStateDeleteFailed = errors.New("credentials: state deletion failed")

+ var ErrStateDurabilityUnknown = errors.New("credentials: state visible commit durability unknown")

+ var ErrStateNamespace = errors.New("credentials: invalid credential state namespace")

+ var ErrStateUnavailable = errors.New("credentials: state operation unavailable")

+ func CatalogTimeValid(value time.Time) bool

+ func CreateCredentialState(ctx context.Context, catalog Catalog, store secrets.Store, ...) error

+ func DeleteCredentialState(ctx context.Context, catalog Catalog, store secrets.Store, ...) error

+ func NewCatalogCanceledError(cause ...error) error

+ func NewCatalogConflictError(ref Reference) error

+ func NewCatalogCorruptError() error

+ func NewCatalogDurabilityUnknownError(ref Reference) error

+ func NewCatalogNotFoundError(ref Reference) error

+ func NewCatalogUnavailableError() error

+ func NewCatalogUnsupportedError() error

+ func PublishState(ctx context.Context, publisher StatePublisher, record Record, ...) error

+ func ValidateRecord(record Record) error

+ type Builder struct

+ Callback CallbackListener

+ Catalog Catalog

+ Clock Clock

+ HTTPClient *http.Client

+ Preconditions secrets.PreconditionCapabilities

+ Providers ProviderFactories

+ RefreshLocks RefreshCoordinator

+ Resolver secrets.Resolver

+ StateIndex secrets.Lister

+ StateNamespace secrets.Namespace

+ StateSharing SharingScope

+ Store secrets.Store

+ func (b *Builder) Build(ctx context.Context, ref Reference) (Source, error)

+ func (b *Builder) Create(ctx context.Context, record Record, value secrets.Secret) error

+ func (b *Builder) Delete(ctx context.Context, record Record) error

+ func (b *Builder) Reconcile(ctx context.Context) ([]Finding, error)

+ type CallbackListener interface

+ type CanceledError struct

+ func NewCanceledError(cause error) *CanceledError

+ func (e *CanceledError) Error() string

+ func (e *CanceledError) Format(state fmt.State, _ rune)

+ func (e *CanceledError) GoString() string

+ func (e *CanceledError) Is(target error) bool

+ func (e *CanceledError) LogValue() slog.Value

+ func (e *CanceledError) Unwrap() error

+ type Catalog interface

+ Create func(context.Context, Record) error

+ Delete func(context.Context, Reference) error

+ Get func(context.Context, Reference) (Record, error)

+ List func(context.Context) ([]Record, error)

+ type CatalogCAS interface

+ Update func(context.Context, Record, Record) error

+ type CatalogDurabilityUnknownError = CatalogError

+ type CatalogError struct

+ func (e *CatalogError) Error() string

+ func (e *CatalogError) Format(state fmt.State, _ rune)

+ func (e *CatalogError) GoString() string

+ func (e *CatalogError) Is(target error) bool

+ func (e *CatalogError) LogValue() slog.Value

+ func (e *CatalogError) Reference() Reference

+ func (e *CatalogError) Unwrap() error

+ func (e *CatalogError) Visible() bool

+ type Clock interface

+ Now func() time.Time

+ type ClockFunc func() time.Time

+ func (f ClockFunc) Now() time.Time

+ type Descriptor struct

+ Audience string

+ Issuer string

+ Label string

+ Provider string

+ Scheme Scheme

+ Transport string

+ Usage UsageClass

+ func NewDescriptor(provider, transport string, scheme Scheme, usage UsageClass, ...) (Descriptor, error)

+ func (d Descriptor) Binding() DescriptorBinding

+ func (d Descriptor) BindingCanonical() string

+ func (d Descriptor) Canonical() string

+ func (d Descriptor) Format(state fmt.State, _ rune)

+ func (d Descriptor) GoString() string

+ func (d Descriptor) LogValue() slog.Value

+ func (d Descriptor) String() string

+ func (d Descriptor) Valid() bool

+ func (d Descriptor) Validate() error

+ type DescriptorBinding struct

+ Audience string

+ Issuer string

+ Provider string

+ Scheme Scheme

+ Transport string

+ Usage UsageClass

+ func DescriptorBindingOf(descriptor Descriptor) DescriptorBinding

+ func StableBindings(factories ProviderFactories) []DescriptorBinding

+ func (b DescriptorBinding) Canonical() string

+ func (b DescriptorBinding) Valid() bool

+ type FactoryInput struct

+ Callback CallbackListener

+ Clock Clock

+ Descriptor Descriptor

+ HTTPClient *http.Client

+ Preconditions secrets.PreconditionCapabilities

+ Record Record

+ Reference Reference

+ RefreshCoordinator RefreshCoordinator

+ Resolver secrets.Resolver

+ State secrets.Reference

+ StateIndex secrets.Lister

+ StateNamespace secrets.Namespace

+ StateSharing SharingScope

+ Store secrets.Store

+ type Failure string

+ func NewFailure(value Failure) (Failure, error)

+ func (f *Failure) UnmarshalText(text []byte) error

+ func (f Failure) Format(state fmt.State, _ rune)

+ func (f Failure) GoString() string

+ func (f Failure) IsZero() bool

+ func (f Failure) LogValue() slog.Value

+ func (f Failure) MarshalText() ([]byte, error)

+ func (f Failure) String() string

+ func (f Failure) Valid() bool

+ func (f Failure) Validate() error

+ type FailureClass = Failure

+ type Finding = ReconcileFinding

+ func Reconcile(ctx context.Context, catalog Catalog, states secrets.Lister, ...) ([]Finding, error)

+ type FindingKind uint8

+ const FindingMissingState

+ const FindingOrphanState

+ func (k FindingKind) String() string

+ type Generation struct

+ func NewGeneration(value string) (Generation, error)

+ func (g *Generation) UnmarshalText(text []byte) error

+ func (g Generation) Format(state fmt.State, _ rune)

+ func (g Generation) GoString() string

+ func (g Generation) IsZero() bool

+ func (g Generation) LogValue() slog.Value

+ func (g Generation) MarshalText() ([]byte, error)

+ func (g Generation) String() string

+ func (g Generation) Valid() bool

+ func (g Generation) Validate() error

+ type InvalidDescriptorError struct

+ func NewInvalidDescriptorError(value string) *InvalidDescriptorError

+ func (e *InvalidDescriptorError) Error() string

+ func (e *InvalidDescriptorError) Format(state fmt.State, _ rune)

+ func (e *InvalidDescriptorError) GoString() string

+ func (e *InvalidDescriptorError) LogValue() slog.Value

+ func (e *InvalidDescriptorError) Reason() string

+ func (e *InvalidDescriptorError) Unwrap() []error

+ type InvalidFailureError struct

+ func NewInvalidFailureError(value string) *InvalidFailureError

+ func (e *InvalidFailureError) Error() string

+ func (e *InvalidFailureError) Format(state fmt.State, _ rune)

+ func (e *InvalidFailureError) GoString() string

+ func (e *InvalidFailureError) LogValue() slog.Value

+ func (e *InvalidFailureError) Reason() string

+ func (e *InvalidFailureError) Unwrap() error

+ type InvalidGenerationError struct

+ func NewInvalidGenerationError(value string) *InvalidGenerationError

+ func (e *InvalidGenerationError) Error() string

+ func (e *InvalidGenerationError) Format(state fmt.State, _ rune)

+ func (e *InvalidGenerationError) GoString() string

+ func (e *InvalidGenerationError) LogValue() slog.Value

+ func (e *InvalidGenerationError) Reason() string

+ func (e *InvalidGenerationError) Unwrap() error

+ type InvalidRecordError struct

+ func NewInvalidRecordError(value string) *InvalidRecordError

+ func (e *InvalidRecordError) Error() string

+ func (e *InvalidRecordError) Format(state fmt.State, _ rune)

+ func (e *InvalidRecordError) GoString() string

+ func (e *InvalidRecordError) LogValue() slog.Value

+ func (e *InvalidRecordError) Reason() string

+ func (e *InvalidRecordError) Unwrap() error

+ type InvalidReferenceError struct

+ func NewInvalidReferenceError(value string) *InvalidReferenceError

+ func (e *InvalidReferenceError) Error() string

+ func (e *InvalidReferenceError) Format(state fmt.State, _ rune)

+ func (e *InvalidReferenceError) GoString() string

+ func (e *InvalidReferenceError) LogValue() slog.Value

+ func (e *InvalidReferenceError) Reason() string

+ func (e *InvalidReferenceError) Unwrap() error

+ type Lease interface

+ Authorizer func() httpauth.Authorizer

+ Descriptor func() Descriptor

+ ExpiresAt func() time.Time

+ Generation func() Generation

+ type NilContextError struct

+ func (e *NilContextError) Error() string

+ func (e *NilContextError) Format(state fmt.State, _ rune)

+ func (e *NilContextError) GoString() string

+ func (e *NilContextError) LogValue() slog.Value

+ func (e *NilContextError) Unwrap() error

+ type NoneSource struct

+ func NewNoneSource(descriptor Descriptor) (*NoneSource, error)

+ func (s *NoneSource) Acquire(ctx context.Context) (Lease, error)

+ func (s *NoneSource) Close() error

+ func (s *NoneSource) Descriptor() Descriptor

+ func (s *NoneSource) Format(state fmt.State, _ rune)

+ func (s *NoneSource) GoString() string

+ func (s *NoneSource) Invalidate(ctx context.Context, generation Generation, failure Failure) error

+ func (s *NoneSource) LogValue() slog.Value

+ func (s *NoneSource) Reference() Reference

+ func (s *NoneSource) String() string

+ type OrphanState struct

+ Credential Reference

+ State secrets.Reference

+ Version secrets.Version

+ func (o OrphanState) Error() string

+ func (o OrphanState) Format(state fmt.State, _ rune)

+ func (o OrphanState) GoString() string

+ func (o OrphanState) LogValue() slog.Value

+ func (o OrphanState) Unwrap() error

+ func (o OrphanState) Valid() bool

+ type ProviderFactories struct

+ func NewProviderFactories(input map[DescriptorBinding]SourceFactory) ProviderFactories

+ func (p ProviderFactories) List() []DescriptorBinding

+ func (p ProviderFactories) Lookup(binding DescriptorBinding) (SourceFactory, bool)

+ func (p ProviderFactories) Snapshot() map[DescriptorBinding]SourceFactory

+ type ReconcileFinding struct

+ Credential Reference

+ Kind FindingKind

+ Reference secrets.Reference

+ State secrets.Reference

+ type Record struct

+ CreatedAt time.Time

+ Descriptor Descriptor

+ Reference Reference

+ Schema uint32

+ State secrets.Reference

+ UpdatedAt time.Time

+ func NewRecord(reference Reference, descriptor Descriptor, state secrets.Reference, ...) (Record, error)

+ func (r Record) Format(state fmt.State, _ rune)

+ func (r Record) GoString() string

+ func (r Record) LogValue() slog.Value

+ func (r Record) String() string

+ func (r Record) Validate() error

+ type Reference struct

+ func NewReference(provider, name string) (Reference, error)

+ func ParseReference(raw string) (Reference, error)

+ func (r *Reference) UnmarshalText(text []byte) error

+ func (r Reference) Canonical() string

+ func (r Reference) Format(state fmt.State, _ rune)

+ func (r Reference) GoString() string

+ func (r Reference) IsZero() bool

+ func (r Reference) LogValue() slog.Value

+ func (r Reference) MarshalText() ([]byte, error)

+ func (r Reference) Name() string

+ func (r Reference) Provider() string

+ func (r Reference) Scheme() string

+ func (r Reference) String() string

+ func (r Reference) Valid() bool

+ func (r Reference) Validate() error

+ type RefreshCoordinator interface

+ Scope func() SharingScope

+ WithLock func(context.Context, Reference, func(context.Context) error) error

+ type Scheme string

+ const SchemeAPIKey

+ const SchemeNone

+ const SchemeOAuth

+ const SchemeSigV4

+ const SchemeWorkloadIdentity

+ func (s Scheme) Format(state fmt.State, _ rune)

+ func (s Scheme) GoString() string

+ func (s Scheme) IsZero() bool

+ func (s Scheme) LogValue() slog.Value

+ func (s Scheme) String() string

+ func (s Scheme) Valid() bool

+ type SharingScope uint8

+ const SharingDistributed

+ const SharingHost

+ const SharingProcess

+ func (s SharingScope) AtLeast(required SharingScope) bool

+ func (s SharingScope) String() string

+ func (s SharingScope) Valid() bool

+ type Source interface

+ Acquire func(context.Context) (Lease, error)

+ Close func() error

+ Descriptor func() Descriptor

+ Invalidate func(context.Context, Generation, Failure) error

+ Reference func() Reference

+ type SourceClosedError struct

+ func (e *SourceClosedError) Error() string

+ func (e *SourceClosedError) Format(state fmt.State, _ rune)

+ func (e *SourceClosedError) GoString() string

+ func (e *SourceClosedError) LogValue() slog.Value

+ func (e *SourceClosedError) Unwrap() error

+ type SourceFactory func(context.Context, FactoryInput) (Source, error)

+ type StateDeletionError struct

+ Credential Reference

+ State secrets.Reference

+ func (e *StateDeletionError) Error() string

+ func (e *StateDeletionError) Format(state fmt.State, _ rune)

+ func (e *StateDeletionError) GoString() string

+ func (e *StateDeletionError) LogValue() slog.Value

+ func (e *StateDeletionError) Unwrap() []error

+ type StatePublicationError struct

+ Orphan *OrphanState

+ func (e *StatePublicationError) Error() string

+ func (e *StatePublicationError) Format(state fmt.State, _ rune)

+ func (e *StatePublicationError) GoString() string

+ func (e *StatePublicationError) LogValue() slog.Value

+ func (e *StatePublicationError) Orphaned() bool

+ func (e *StatePublicationError) Unwrap() []error

+ type StatePublisher struct

+ Catalog Catalog

+ Namespace secrets.Namespace

+ Preconditions secrets.PreconditionCapabilities

+ Store secrets.Store

+ func (p StatePublisher) Create(ctx context.Context, record Record, value secrets.Secret) error

+ func (p StatePublisher) Delete(ctx context.Context, supplied Record) error

+ type UsageClass string

+ const UsageLocal

+ const UsageMeteredAPI

+ const UsageSubscription

+ func (u UsageClass) Format(state fmt.State, _ rune)

+ func (u UsageClass) GoString() string

+ func (u UsageClass) IsZero() bool

+ func (u UsageClass) LogValue() slog.Value

+ func (u UsageClass) String() string

+ func (u UsageClass) Valid() bool

v0.1.0

Aug 10, 2026