diff --git a/credentials.md b/credentials.md
new file mode 100644
index 0000000..0184b67
--- /dev/null
+++ b/credentials.md
@@ -0,0 +1,21 @@
+# Harbor Credentials Reference
+
+All secrets stored in `ai-workspace/settings/credentials.env`. Never commit actual values.
+
+| Key | Purpose | Location |
+|---|---|---|
+| `CF_API_TOKEN` | Cloudflare API (DNS records) | credentials.env |
+| `CF_ZONE_ID` | Cloudflare zone for snsnetlabs.com | credentials.env |
+| `NPM_EMAIL` | NPM login | credentials.env |
+| `NPM_PASSWORD` | NPM login | credentials.env |
+| `FORGEJO_API_TOKEN` | Forgejo API access | credentials.env |
+| Casa sudo | VM sudo password | credentials.env (PRE_SUDO_PASSWORD) |
+
+## Access Paths
+
+| Target | Method |
+|---|---|
+| Casa VM | `ssh pre` → `ssh casaos` |
+| Linode NPM API | `ssh pre` → `ssh linode` → `curl localhost:81/api/...` |
+| Cloudflare API | Direct HTTPS from any machine |
+| Forgejo API | `http://192.168.122.102:3000/api/v1/` |