---
credentials:
  litellm_api_key:
    description: Per-consumer virtual key for the shared svc-ai-litellm gateway
    algorithm: sk_prefixed
    validation:
      min_length: 50
  postgres_password:
    description: "Password for the Zammad PostgreSQL user (used against the central svc-db-postgres or any provider compatible with it)."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{16,}$"
    length: 32
  secret_key_base:
    description: "Rails `secret_key_base` for Zammad (sessions, encrypted cookies). Stable across deploys to avoid invalidating sessions."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{64,}$"
    length: 128
  initial_admin_password:
    description: "Password seeded into Zammad on first start for the bootstrap administrator account. Used once to bypass the setup wizard."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{16,}$"
    length: 32
  api_token:
    description: "Long-lived Zammad API token pinned on the read-only MCP agent, which the MCP adapter presents to Zammad."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 64
  mcp_bearer:
    description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the upstream credential the adapter presents, because authenticating
      to the application says nothing about who called the adapter."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48