Free operations template
Credential inventory template
A clean CSV for mapping ownership, expiry, and rotation policy. Use it on its own today, then import it into KeyGuardRail when you are ready.
Import-compatible
Example inventory
The file uses KeyGuardRail’s exact import header and includes three clearly fictional examples you can replace.
| Name | Provider | Type | Environment | Owner | Next signal |
|---|---|---|---|---|---|
| Stripe production | Stripe | API key | Production | Payments platform | Expires Dec 15 |
| GitHub deploy app | GitHub | OAuth client | Production | Platform engineering | Rotate in 90 days |
| AWS backup role | AWS | Access key | Production | Infrastructure | Rotate in 90 days |
Field guide
One row per credential identity.
Keep the sheet useful to operators and safe to share with the people coordinating lifecycle work.
name- A recognizable system label—not the credential value.
provider- The cloud, SaaS platform, vault, or internal issuer.
credential_type- API key, access key, certificate, OAuth client, service account, token, or other.
environment- Production, staging, development, or shared.
owner- The accountable team or person who can coordinate rotation.
expires_on- The provider expiry date in YYYY-MM-DD format, when one exists.
last_rotated_on- The last confirmed rotation date in YYYY-MM-DD format.
rotation_interval_days- Your policy interval, such as 90 or 365 days.
runbook_url- An HTTPS link to the authorized rotation procedure.
Keep outside the sheet
Never add the value being protected.
- No passwords or API keys
- No private keys or certificate bodies
- No access tokens or recovery codes
- No copied secrets in comments or runbooks
Import into KeyGuardRail
Track the inventory with your team
KeyGuardRail imports this file atomically, calculates the earliest lifecycle deadline, and keeps every follow-up attached to an owner.
The imported schema has no secret-value field.