# Accounts and credentials

> One profile per AWS account, its credentials, and the checks that keep them valid.

Every AWS account Douklar talks to is a **profile**. A profile holds that
account's credentials and nothing else; each account is reached with its own
profile.

## Credential sources

Each profile uses one of:

- **Static access keys**, stored encrypted at rest in the app's credential store.
- **IAM Identity Center (SSO)**, signed in from the app with a device login,
  with role selection and an optional single-hop `AssumeRole`.

A profile's preference decides which source it uses. Douklar uses **only the
credentials configured in the profile**; it does not read ambient credentials
from the host or container, so a run uses an identity you configured.

## Account checks

Douklar verifies each account with AWS STS on an interval you choose: Off, 5,
15 (default), 30, 60 or 240 minutes. The open console triggers these checks;
there is no server-side scheduler.

A failed check appears on the Overview under "Needs attention", with the
account and the error AWS returned.

## Credential expiry and runs

Preflight checks whether a profile's credentials will expire during the run.
By default it warns; it can be set to block. The default margin is 900
seconds.

## Source and destination

A mapping needs two different profiles. They may point at the same AWS
account (same-account mode), but an overlap guard refuses a mapping whose
source and destination are the same resource.

## What is protected

- Static keys, SSO sessions and provider secrets are encrypted at rest.
- Logs and errors redact authorization headers, cookies, session ids and
  presigned URL signatures.
- Commands run without a shell, from an allowlist (`aws`, `git`, `oras`), by
  absolute path.

Source: https://douklar.app/docs/douklar/accounts-and-credentials (Douklar docs, last checked 2026-10-17)