# Injected credentials

> Provide website credentials for autofill through Extended Preferences without adding ordinary saved passwords.

Source: https://console.getchrovia.com/en/docs/sdk-injected-credentials

**Entitlement:** `injectedCredentials`. **Configuration:** `internal.injected_credentials`, an array. No JavaScript API or `extendedPrefs` entitlement is needed merely for the kernel to consume this section.

## Configure a test login

```json
{
  "internal": {
    "injected_credentials": [
      {
        "url": "https://example.com/login",
        "username": "sdk-test-user",
        "password": "replace-with-a-test-password"
      }
    ]
  }
}
```

Use your own test site and credentials. Merge into the [EP](https://console.getchrovia.com/en/docs/sdk-extended-preferences), re-sign if required, and restart before opening the login page. Focus a recognized login field to test Chromium's autofill suggestions. This is not a guarantee of automatic submission or compatibility with every custom form.

## Fields and matching

Each item needs string `url`, `username`, and `password` fields. The URL must be valid HTTP(S). Entries are grouped by Chromium's sign-on realm, not a CSS selector or exact page path. A credential for `/login` is not restricted to that path. Multiple entries for the same realm can supply multiple accounts.

Malformed entries and non-HTTP(S) URLs are skipped with a log. Fully restart after editing credentials; changing the file does not update a running instance.

## Autofill without ordinary saved passwords

Injected credentials are offered for autofill but are not added as ordinary saved passwords. For matching login realms, the browser suppresses the corresponding save, update, and related password-management prompts. It does not ask to save the injected account as a newly discovered password.

Use [passwords](https://console.getchrovia.com/en/docs/sdk-passwords) when you need actual saved-password import/export or change observation. Avoid supplying the same site/account through both mechanisms; they have different persistence and UI contracts.

Passwords remain readable in the file, including signed files. Restrict file access and avoid exposing them to pages through `unrestrictedApi` plus `extendedPrefs`.

## Update and verify

Replace credentials in the instance EP, re-sign signed fields, and restart. Removing the overlay does not delete independently saved passwords from the Profile. If suggestions are missing, check the entitlement, EP verification, realm, recognized form, and whether you are testing the actual updated user-data directory.

Optional [password reveal block](https://console.getchrovia.com/en/docs/sdk-password-reveal-block) changes supported reveal UI, but does not turn injected secrets into data the receiving site cannot access.