Credentials
How credentials work in Scanopy — types, targets, assignment, and resolution.
Credentials provide daemons with the authentication details they need to gather data during discovery. Without credentials, discovery is limited to port scanning and DNS lookups. With credentials configured, a daemon can also query devices for their details, interfaces and neighbors, connect to container APIs, or read a network controller's inventory.
Credential Types
Scanopy supports these credential types, grouped by the integration they enable. Each type can be pointed at one or more targets — see Where a credential applies.
| Integration | Credential type | What it discovers | Can be targeted at |
|---|---|---|---|
| Docker | Docker Proxy | Discover Docker containers and the services they expose. | Daemon hostRemote hosts |
| Docker Socket | Daemon host | ||
| Podman | Podman Proxy | Discover Podman containers and the services they expose. | Daemon hostRemote hosts |
| Podman Socket | Daemon host | ||
| SNMP | SNMP v1 | Discover a host's interfaces, system details, and CDP/LLDP neighbors. | NetworkDaemon hostRemote hosts |
| SNMP v2c | NetworkDaemon hostRemote hosts | ||
| SNMP v3 | NetworkDaemon hostRemote hosts | ||
| UniFi Controller | UniFi API KeyBeta | Discover UniFi-managed switches, access points and gateways, their ports, and the LLDP neighbors and uplinks the controller sees. | Daemon hostRemote hosts |
| UniFi Local AdminBeta | Daemon hostRemote hosts |
Each integration's guide covers what's specific to it — what the other side needs configured, which transport to choose, and how to verify it: Docker, Podman, SNMP, and UniFi Controller.
Creating a credential
Creating a credential works the same way for every integration:
- Go to Assets > Credentials
- Click Create Credential
- Select the credential type — the transport, not just the integration (e.g. SNMP v2c, Docker Proxy, UniFi API Key)
- Enter a name that will make sense later ("Core switches", "HQ controller")
- Fill in the type's fields — each integration's guide lists them
- Click Save
Secrets — community strings, passwords, API keys, private keys — are not shown again in the UI or in API responses once saved.
A credential does nothing until it's pointed at something. That's the next step.
Where a credential applies
Every credential is pointed at one or more targets, which determine the hosts the daemon tries it on:
| Target | Meaning |
|---|---|
| Network | Every host on a network. The daemon tries the credential on each host it scans there — the Target All Hosts option in the wizard. |
| Daemon host | The daemon's own machine (127.0.0.1). Used for local Docker and Podman sockets. |
| Remote hosts | Specific hosts you name by IP address. |
Not every type supports every target — the Can be targeted at column above shows which. A protocol that any device can speak reaches a whole Network; a local socket reaches only its daemon host; a proxy or controller names the one host its endpoint lives on. An unsupported assignment is rejected on save, and changing a credential's type drops assignments the new type doesn't allow.
Attaching a credential
Where you attach a credential depends only on whether the host exists yet:
| Attach it | When |
|---|---|
| While setting up a daemon | Before anything has been scanned |
| From a discovery | An existing daemon starts covering a new segment |
| On a host | The host has been discovered, and needs something different from its network's default |
The first two name a target by IP, since the host isn't in Scanopy yet — see auto-assignment. An assignment made on a host can be narrowed to specific interfaces, which matters when a credential is reachable only one way in.
Credential Resolution
When the daemon scans a host, it resolves credentials in this priority order:
- Host-level assignment — credentials assigned directly to the host (or its specific interface)
- Network default — credentials targeted at the host's whole network
- Fallback — for SNMP, the community string
publicis tried as a last resort
All available credentials at each level are tried — not just the first match. If every credential fails (timeout or authentication error), the host is scanned without that credential type's data.
Auto-Assignment
Naming a target by IP covers the gap between knowing a device's credentials and Scanopy having discovered it. The next scan tries the credential at that address; if it works, the credential is assigned to whatever host was found there. Until then it shows as unassigned — expected, not a failure.
The target is used once, and cleared when the scan ends whether or not it matched, so nothing is re-probed forever. A target covering a whole Network moves into that network's assignment rather than being dropped.
If auto-assignment isn't working, see Troubleshooting credentials.