# Don't save credentials in repo

**URL:** <https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111>\
**Category:** Questions\
**Created:** [June 12, 2024, 7:20am UTC](https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111 "2024-06-12T07:20:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andboy](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@andboy](https://discuss.dvc.org/u/andboy)\
**Post date:** [June 12, 2024, 7:20am UTC](https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111/1 "2024-06-12T07:20:31Z")

</div>

I’m importing files from a webdav:  
`dvc import-url webdavs://host/remote.php/dav/files/username/path/to/file --fs-config user=username password=password`  
The problem is, dvc then adds the credentials to .dvc file

 ![image](https://canada1.discourse-cdn.com/flex035/uploads/dataversioncontrol/original/1X/23c0c35ecc54b3a5df2b8c486d6ce851ce08ccac.png)  
Is there a way to prevent that?

---

<div class="post-metadata">

**Author:** ![nancy79](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.dvc.org/nancy79/32/336_2.png) [@nancy79](https://discuss.dvc.org/u/nancy79)\
**Post date:** [June 12, 2024, 10:56am UTC](https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111/2 "2024-06-12T10:56:28Z")

</div>

> [@andboy](#):
>
> I’m importing files from a webdav:  
> `dvc import-url webdavs://host/remote.php/dav/files/username/path/to/file --fs-config user=username password=password`  
> The problem is, dvc then adds the credentials to .dvc file

Hey there  
After going through your query it sounds like you’re encountering a security concern by inadvertently saving credentials in your repository. When importing files from a webdav using dvc, ensure that credentials aren’t stored in the .dvc file for security reasons. You might want to explore alternative authentication methods or encrypting the credentials to mitigate this risk.

---

<div class="post-metadata">

**Author:** ![skshetry](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@skshetry](https://discuss.dvc.org/u/skshetry)\
**Post date:** [June 12, 2024, 1:52pm UTC](https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111/3 "2024-06-12T13:52:22Z")

</div>

Hi, you can setup a webdav remote in dvc, and use it to import.

See [WebDAV](https://dvc.org/doc/user-guide/data-management/remote-storage/webdav#webdav).

For example, you can setup remote with a name (eg: `myremote`) as follows:

```console
dvc remote add -d myremote \
      webdavs://example.com/owncloud/remote.php/dav/files/username

```

You can similarly set `user` and `password` as follows:

```console
dvc remote modify myremote user username
dvc remote modify --local myremote password password123

```

Please refer to the above link for more options.

After that, you can import using `remote://<remote_name>` and then add relative path to the url you added as a remote (eg: `example.com/owncloud/remote.php/dav/files/username` in above case).

For downloading, `host/remote.php/dav/files/username/path/to/file`, it’ll look as follows:

```console
dvc import-url remote://myremote/path/to/file

```

---

<div class="post-metadata">

**Author:** ![andboy](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@andboy](https://discuss.dvc.org/u/andboy)\
**Post date:** [June 17, 2024, 10:20am UTC](https://discuss.dvc.org/t/dont-save-credentials-in-repo/2111/4 "2024-06-17T10:20:54Z")

</div>

Big thanks, couldn’t find that in the docs.

Also, do you know if it’s possible to use env variables for credentials without running `dvc remote modify`?