> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/docsfab/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/docsfab/_mcp/server.

# Configured-Credential Matching Limits in DocsFab

> Look up exact configured-credential matching budgets and refusal behavior.

Look up exact configured-credential matching budgets and refusal behavior.

## Configured-Credential Matching

DocsFab matches its own configured credentials exactly, as
[Security and Trust](/docsfab/reference/security-and-trust) describes. You can set each
setting through its environment variable or by name in the host limits file,
within its catalog range. Startup refuses a value outside that range, and
`docsfab doctor --limits` reports the effective values. The following settings
control which configured values, and which pieces of them, the exact-match
screens compare.

| Setting | Default | Behavior |
| --- | --- | --- |
| `DOCSFAB_SECRETS_CONFIGURED_CREDENTIAL_MIN_CHARS` | 12 characters | Shortest configured credential value the exact-match screens compare. You can lower it to 8 to compare shorter values, or raise it to 64 to compare fewer. |
| `DOCSFAB_SECRETS_CONFIGURED_CREDENTIAL_FRAGMENT_CHARS` | 16 characters | Shortest piece of a configured credential that matches, so a truncated echo is still found. You can raise it to 64 so that only longer pieces match. |
| `DOCSFAB_SECRETS_CONFIGURED_CREDENTIAL_MIN_DISTINCT_CHARS` | 5 distinct characters | Fewest distinct characters a configured value, or a piece of one, needs to be compared. You can lower it to 1, which turns the rule off, or raise it to 16. |


Lowering a minimum compares more configured values, such as a short password or
one built from a repeated word. Such a value also appears in ordinary text by
chance more often, so more runs refuse content that holds no credential.
Raising a minimum compares fewer configured values.

`docsfab doctor` prints a `Configured credential not compared` line when a
configured value is shorter than `secrets.configuredCredentialMinChars` or has
fewer distinct characters than `secrets.configuredCredentialMinDistinctChars`.
The line names where the value is configured, such as an environment variable
or a credential file, the rule that the value fails, and the setting that
compares such values. It never shows the value or its length.

DocsFab reads the files that variables such as `*_TOKEN_FILE` name, and lists
systemd's `$CREDENTIALS_DIRECTORY`, when it loads its configuration and each
time it reloads it. A value that DocsFab read from such a file earlier, such as
a token that you rotated out, still matches until the process exits. A hosted
attempt runs without the host's environment and limits file, so these settings
keep their catalog defaults inside it.