# Set up customer credentials in the hub

> Prove your domain, design the credential your customers will hold, connect your app and register your site for HumanProof. About ten minutes.

Source: https://docs.trustaige.com/customer-credentials/setup

Replace these placeholders with your organization's own values:

- `<your-org-id>`: Organization short ID, for example `a1B2c3D4e5F6`. The part after /o/ in your hub’s address.
- `<your-client-id>`: App client ID, for example `q3Jx8vN2mZ0bT5sLwK7yHc4dR1fGaE9uPiO6nVjXkMs`. On the app’s page in the hub, under Credentials.
- `<your-client-secret>`: Client secret, a secret. From the hub: on the app’s page under Credentials. Keep it on your server.

Do this once, in the Trustaige hub, as an administrator of your organization.

1. **Prove your domain.** In **Domains**, add a DNS record. Credentials you
   issue carry the domain you proved, so people can see they are yours.

2. **Turn on issuing and design one credential.** In **Customers → Overview**,
   choose **Turn on issuing**, then **Design a credential**. Start from
   **Customer account**: it lasts while they're your customer and renews on its
   own. Leave who can get it as **People you offer it to**.

3. **Connect your app.** In **Customers → Overview**, choose **Connect your
   app**: the new-application flow opens with **Customers** chosen. Admit your
   credential. Add your callback URL as a redirect URI, your home page as a
   post-logout URI, and your sign-in route as the initiate login URI. Note its
   client ID and secret.

4. **Register your site for HumanProof.** In **HumanProof → Sites**, add your
   site's host. Your sign-up form can then ask a visitor to prove they are a
   person, without learning who. See [HumanProof](/humanproof).

## One app does both halves

Your customers sign in through the app you connected, and your server calls the
hub with the same client to offer, read and end the credentials it admits. For
those calls a Customers app always holds three scopes, which come with the app:
there's nothing to set up or grant, and you only choose which to request on a
token.

| Scope | Lets your server |
|---|---|
| `offers:write` | Offer a credential: create a subject and a claim link |
| `issued:read` | Read your credential types and the subjects you created |
| `issued:manage` | Erase a subject |

Its calls are named as the app in your organization's audit log, and what it
creates is its own: a subject it minted is invisible to any other app in your
organization, which reads it as `404`.

## Your four values

The credential type's name is the one you entered when you designed it.
`Customer` below is an example, not a reserved name: names are unique within
your organization and permanent, and yours must match exactly.

```bash title=".env"
TRUSTAIGE_ISSUER=https://id.trustaige.com/o/<your-org-id>
TRUSTAIGE_CLIENT_ID=<your-client-id>
TRUSTAIGE_CLIENT_SECRET=<your-client-secret>
TRUSTAIGE_CREDENTIAL_TYPE=Customer
```

> **Important:** Keep the client secret on your server only: in your secret store, never in the
> browser or your repository.

Next: [sign people up](/customer-credentials/sign-up).