> ## Documentation Index
> Fetch the complete documentation index at: https://docs.msportal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure credential handoff guides

> How MSPortal protects credentials during client onboarding, and where to find the steps to submit and retrieve them.

During onboarding, clients often need to share sensitive details such as admin passwords, API keys, or service account logins. Credential handoff is a purpose-built task that encrypts what the client submits and lets your team retrieve it once. This page explains how it works and links to the step-by-step guides.

## Find the guide you need

* **Clients** submit details in Single or Bulk mode. See [Hand over credentials](/user-guides/client-onboarding/hand-over-credentials).
* **Clients** can also send encrypted files. See [Upload documents and secure files](/user-guides/client-onboarding/upload-files).
* **MSP staff** reveal a credential or download a secure file. See [Retrieve credentials and secure files](/user-guides/client-onboarding/retrieve-secure-submissions).
* **MSP staff** add a **Credential Handoff** or **Secure File Drop** task to a template. See [Onboarding Templates](/user-guides/client-onboarding/templates).

## How it works

**1. The client submits**

The client fills in **Username**, **Password**, **API Key**, and **Notes** (Single mode), or pastes text and attaches a file (Bulk mode). A confirmation reminds them they cannot edit the submission afterward.

**2. MSPortal encrypts it**

The details are encrypted with AES-256-GCM using a unique random key. The key is stored in a separate secrets vault, apart from the encrypted data.

**3. You reveal it once**

On the credential task, you select **Reveal Credentials** and confirm **Reveal & Delete**. The details show for 5 minutes so you can copy them.

**4. The stored copy is deleted**

When you reveal the credentials, MSPortal deletes the encrypted data and its key. Nobody can retrieve the submission again.

## What protects the data

| Protection | How it works |
| - | - |
| Encryption | AES-256-GCM, which also detects tampering |
| Key separation | Each submission has its own key, stored in a secrets vault apart from the data |
| One-time retrieval | A submission can be revealed or downloaded once. The stored copy is deleted when it is |
| Expiry | A submission that is not retrieved within 30 days shows **Expired**. The client must submit again |
| Display limit | Revealed credentials hide themselves after 5 minutes |
| Activity record | Portal activity records **Credentials Submitted** and **Credentials Revealed** events. Reveals record the staff member, and submissions record the client's email |

## Credential statuses

| Status | Meaning |
| - | - |
| **Pending Reveal** | The client submitted details and they are waiting for your team |
| **Revealed** | Your team revealed them and the stored copy was deleted |
| **Expired** | Nobody retrieved them within 30 days. Create a new handoff task |

## What to tell your clients

> [!TIP]
>
> You can share this with clients to build trust. "Your credentials are encrypted the moment you submit them. The encryption key is stored separately from the encrypted data. Our team can view them one time, and then the stored copy is deleted. If we have not retrieved them after 30 days, they expire and you will need to submit them again."

## Troubleshooting

| Problem | What to do |
| - | - |
| You revealed a credential and did not copy it | It cannot be retrieved again. Create a new handoff task and ask the client to resubmit. |
| A submission shows **Expired** | Create a new credential handoff task. |
| The client made a mistake | Create a new handoff task. Clients cannot edit a submission. |

## Frequently asked questions

> **Can I reveal credentials more than once?**
>
> No. They can be revealed once. If you need them again, create a new credential handoff task.

> **What happens if nobody reveals them in 30 days?**
>
> The submission shows **Expired** and cannot be retrieved. Create a new handoff task and ask the client to resubmit.

> **Can a client edit credentials after submitting?**
>
> No. If they made a mistake, create a new handoff task for them.

> **Where are the encryption keys stored?**
>
> In a secrets vault that is separate from the database that holds the encrypted data. Each submission has its own key.

> **What encryption does it use?**
>
> AES-256-GCM, which protects both the privacy and the integrity of the data.

## Related guides

* [Client onboarding overview](/user-guides/client-onboarding/index)
* [Understand the client onboarding portal](/user-guides/client-onboarding/client-portal)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.