> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/ccluster/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/ccluster/_mcp/server.

# Managing Vault Objects

> How to generate and store NVIDIA CCluster tokens and other vault objects

The NVIDIA CCluster allows you to generate and manage `Vault` objects such as `Bearer Tokens`, `Certificates`, `Registry Credentials`, `Environment Variables`, `Hugging Face Tokens`, and `SSH Keys`.
This guide will walk you through creating `Bearer Tokens` and other Vault objects you can use to configure or access NVIDIA CCluster services.

> **Note**
>
> Vault **bearer tokens** protect your deployed inference endpoints — clients include them in requests to LLM Serving and General Inference URLs. For **platform API automation** (SDK, CLI, deployment management without browser login), use [Service Accounts](/ccluster/resources/service-accounts) instead.

## Step 1: Log in to the NVIDIA CCluster

You will need to log in to the NVIDIA CCluster to manage Vault objects. If you do not yet have access, contact your NVIDIA representative or your organization's designated support contact before proceeding.

Once logged in, you will need to select `Account` from sidebar menu, and then click on the `Vault` tab from the `Your Account` window.

![Vault section of the account page](/ccluster/_fern-files/_img/1933ce1848da6da185f8b9f624dd0ce75a6ec3d48f5e09f8ab40a904fd443369.webp)

Once completed, move onto the second step below based on the type of Vault objects you are creating.

## Step 2A: Creating bearer tokens

Bearer tokens can be used to access NVIDIA CCluster services.

To generate a bearer token, select green `Add Vault Item`. A dropdown menu will appear. From that menu, select the `Bearer Tokens` option.

![Add Vault Item menu showing Bearer Tokens option](/ccluster/_fern-files/_img/b40e4623d32b95ca0ec457d9a359a7d33f4d51392ae0b7e7b6dafb63a2da17fb.webp)

A windows will pop up name `Add Bearer Token to Your Vault`. From there, you can either name and automatically generate a token with the `Generate new Bearer Token` option or you can enter a previous token using the `Use an existing Bearer Token` option.

![Form for adding a new bearer token to the vault](/ccluster/_fern-files/_img/5777149e9ab0eaf3383b8268809d0efbd97f84135428a3b274c907bde4323b5e.webp)

Once you either enter your token in the text box or opt into generating your token, click the green `Add to Vault` option and your Bearer Token should appear in your vault.

![Bearer token listed in the vault after creation](/ccluster/_fern-files/_img/750d71e45312615d75c8f9f5d8c06bd119afa24066135212f24e43606c3a8059.webp)

## Step 2B: Adding certificates to your vault

NVIDIA CCluster uses client certificates for [mutual TLS (mTLS)](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/)
You can generate or add public certificates for mTLS just like you can with Bearer Tokens. Once you generate the certificate, it will appear in the vault.

![Add Vault Item menu showing Certificates option](/ccluster/_fern-files/_img/0418be3ef6dc973f285f953285bde978b7075e221a47d025db3c6a87ba1bd43f.webp)![Certificate generation form in the vault](/ccluster/_fern-files/_img/35f1333bd988fa62ee0602c49565f3b0bca2eef785bbafeb5431300c134dd7a3.webp)![Generated certificate listed in the vault](/ccluster/_fern-files/_img/bcdf9c00726109d7b9569d1ecf8092c83b4c2135c1115d69b98ab73a6bd63d3a.webp)

When generated, `Vault Certificates` download a `.pem` file to your local browser. That `.pem` file is named after the generated cert. You can then use that `.pem` file to access one of NVIDIA CCluster's [secured endpoints](/ccluster/resources/private) as long as they are associated with the appropriate certificate and `.pem` pair.

![Browser download prompt for the generated .pem file](/ccluster/_fern-files/_img/26983248281c27a3b0859def2a42a612df0d4b109ba9666fa77fa984084b1aca.webp)

### Example usage

```bash showLineNumbers={false}
curl -X POST 'https://centml-private-2.fe178792.c-09.centml.com/openai/v1/chat/completions' \
  --cert gen-cert.pem \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "messages": [
      {
        "role": "user",
        "content": "what is the meaning of life?"
      }
    ],
    "model": "meta-llama/Llama-3.2-3B-Instruct",
    "max_tokens": 512,
    "n": 1,
    "presence_penalty": 0,
    "stream": true,
    "stream_options": {
      "include_usage": true
    },
    "temperature": 0.7,
    "top_p": 1
  }'

```

### Adding your own certificates

This section is currently under construction as we work to improve the UX around adding certificates to endpoints on the NVIDIA CCluster. Please check back soon!

## Step 2C: Adding registry credentials

Registry credentials allow the NVIDIA CCluster to pull container images from private registries when creating [General Inference](/ccluster/apps/inference) or [Compute](/ccluster/apps/compute) deployments.

To add registry credentials, select the green `Add Vault Item` button and choose `Registry Credentials` from the dropdown. Enter a name, along with the registry username and password (or access token). The credentials are stored securely in your Vault and can be selected during deployment configuration.

Supported registries include Docker Hub, Amazon ECR, Google Artifact Registry, Azure Container Registry, and any Docker-compatible private registry. CCluster automatically detects the registry from the image URL at deployment time.

## Step 2D: Adding environment variables

![Form for adding an environment variable to the vault](/ccluster/_fern-files/_img/06e634d2a150dbfbb71e8318a38f826b8dc2ebef017b813e69ec4280266c57fb.webp)![Environment variable listed in the vault](/ccluster/_fern-files/_img/ebdc0895106f27034a40bacd1ec68bd0be7759eb0872b565e85d5962fb13bab7.webp)

## What's next

#### [LLM Serving](/ccluster/apps/llm)

Explore dedicated, protected endpoints for production model deployments.

#### [Securing Endpoints](/ccluster/resources/private)

Learn how to protect your endpoints with Bearer tokens and mTLS certificates

#### [Clients](/ccluster/clients/setup)

Learn how to interact with the NVIDIA CCluster programmatically