IT Glue Passwords Management

Overview

Passwords in IT Glue provide secure credential storage with organization-level access control. This skill covers password creation, categorization, folder organization, and security best practices for managing sensitive credentials within MSP documentation.

Anti-triggers

• A credential stored in a flexible asset's password-type field —

those are not Passwords records and will not appear in search_passwords; use itglue-flexible-assets.

• A password embedded in a runbook — the document references the

record rather than holding it; use itglue-documents.

• The device the credential opens — use itglue-configurations.

Key Concepts

Password Categories

Passwords are organized by category for classification:

Password Folders

Folders provide hierarchical organization within an organization:

Organization: Acme Corporation
└── Passwords
    ├── Infrastructure
    │   ├── Domain Controllers
    │   ├── File Servers
    │   └── Network Devices
    ├── Applications
    │   ├── ERP System
    │   └── CRM
    └── Cloud Services
        ├── Microsoft 365
        └── AWS

Embedded Passwords

Passwords can be embedded directly within documents and flexible assets (<div data-embedded-password-id="12345"></div>), providing contextual credential access alongside documentation.

See references/fields.md for the complete field reference.

API Patterns

• The password value is not returned by default. Retrieving the actual credential requires GET /passwords/:id?show_password=true — this is logged in the IT Glue audit trail.
• List endpoints omit the `password` field entirely — it's only present when fetching a single password with show_password=true.
• Passwords can be filtered by organization, category, or folder in combination (filter[organization-id], filter[password-category-id], filter[password-folder-id]).

See references/api.md for the complete endpoint catalog: password and password-folder CRUD, search, and embedding syntax.

Common Workflows

Secure Password Creation

Resolve or create the target folder, then create the password with a category and a notes field documenting purpose — and log the creation to your own audit system in addition to IT Glue's built-in logging.

Password Rotation

Update the password value and append a rotation note (timestamp + reason) to the existing notes rather than overwriting them, so the credential's change history stays visible in IT Glue.

See references/examples.md for the full createSecurePassword and rotatePassword implementations, plus context search, category reporting, and stale-password detection workflows.

Security Best Practices

Access Control

1. Principle of least privilege - Only grant password access to those who need it
2. Regular access reviews - Periodically audit who has access to passwords
3. Use restricted flag - Mark sensitive passwords as restricted
4. Folder permissions - Organize passwords into folders with appropriate access

Password Hygiene

1. Regular rotation - Rotate passwords on schedule (90 days recommended)
2. Strong passwords - Enforce complexity requirements
3. Unique passwords - Never reuse passwords across systems
4. Track changes - Document when and why passwords change
5. Monitor stale passwords - Alert on passwords not updated recently

Audit Logging

IT Glue logs all password access automatically. Layer your own audit logging on top for actions IT Glue doesn't track natively (e.g. who copied a value in a downstream tool) — see references/errors.md for a secure error-handling pattern that logs unexpected access failures without leaking whether a password exists.

Gotchas

• `show_password=true` is required to get the actual credential — omitting it silently returns the password record without the password field, which looks like a missing-data bug rather than an intentional security gate.
• Every retrieval with `show_password=true` is audit-logged — avoid calling it in loops or bulk scripts unless you actually need the plaintext value for each record, since it generates one audit entry per call.
• Deleting removes audit history — archive or otherwise preserve the record instead of deleting when a credential is retired, so past access can still be reviewed.

See references/errors.md for the complete error-code and validation-error tables.

Best Practices

1. Use categories - Classify all passwords for organization
2. Organize with folders - Create logical folder hierarchy
3. Document purpose - Include notes explaining what the password is for
4. Track URLs - Always include login URL when applicable
5. Embed contextually - Place passwords in related documents
6. Include 2FA - Store TOTP secrets with otp-secret field

Related Skills

• IT Glue Organizations - Password organization scope
• IT Glue Configurations - Device-related credentials
• IT Glue Documents - Embedding passwords in docs
• IT Glue Flexible Assets - Password fields in assets
• IT Glue API Patterns - API reference