# Credentials: the target shape The swarm's credential store is bao. This page is the overview of how the swarm treats credentials; [`credentials-reference.md`](credentials-reference.md) lists each one: who mints it, who reads it, and how it renews, with the notes for operating them. It describes the target, not what's on disk today; the reference also maps [the files that exist right now](credentials-reference.md#where-each-secret-lives). **Store secrets stay off disk.** A process pulls a value from the store at runtime and holds it in memory only. **The mTLS client certificate is the only credential on disk.** Each identity (an agent, a hive, a swarm-level service) has one. It's what logs a principal in to the store, so you place a hive's or service's certificate by hand. The nix option for it takes a path to the certificate, never its bytes, because a literal in a nix expression lands in the world-readable nix store. A hive hands each agent its certificate; the agent pulls everything else itself. **Each credential has a minter, a reader and a renewal story.** Who mints it, who reads it, and whether it renews without an operator are what the [reference table](credentials-reference.md) gives for every credential, with the operating notes that go with them.