Skip to main content
All glossary terms

Credentials & security

Host-scoped credentials

Host-scoped credentials are credentials configured for use only with a named destination host or host pattern. Scoping helps prevent a secret intended for one service from being attached to requests for an unrelated destination, subject to the matching rules of the implementation.

Also known as host-bound credentials.

Why it matters in practice

Correct scoping depends on parsing the request authority consistently, including port, scheme, redirects, and any permitted subdomains. Teams should test edge cases and avoid broad wildcard patterns they do not need. Host scoping narrows a credential’s intended use but does not prove that the destination itself is safe.

Example

A vault binds one key to api.example.com, and a request to a different host does not receive that credential.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.