diff --git a/operator-token-runbook.md b/operator-token-runbook.md
index 6fabfc1..c047a78 100644
--- a/operator-token-runbook.md
+++ b/operator-token-runbook.md
@@ -133,3 +133,70 @@ email" problem — it is not; verify the scope first.)
 revoked). Fix: re-add the `email` scope to the token on Open Collective
 (Settings → Developers → Personal Tokens). No token rotation, no re-granting of
 admin — just the scope.
+
+## Credential inventory (draft, 2026-10-26)
+
+Every credential the agent and the member-facing apps hold, compiled from the
+public code and docs. **No secret values appear here, only names and roles.**
+"Where it lives" and "Who rotates" are filled in where the docs say; blank
+cells are for the operator to complete. When rotating anything, check every
+row that names the same credential: several are held by more than one app.
+
+### Member portal (`portal.inference.coop`)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| `CLOUDRON_TOKEN` (portal token) | Create users and groups, invite links | Portal app env | GM | See "The two-token split" above |
+| `OC_PERSONAL_TOKEN` | Read members and orders from Open Collective GraphQL | Portal app env | The Open Collective account that minted it | Needs the `email` scope (see below). Currently a personal token; a co-op-owned OC account would make it a co-op credential |
+| `WEBHOOK_TOKEN` | Secret in the Open Collective webhook URL | Portal app env, and the webhook URL on Open Collective | GM | Rotating means re-creating the webhook on OC as well |
+| `LITELLM_MASTER_KEY` | Create gateway teams and keys for members | Portal app env (copy of the gateway's) | GM | Also held by the gateway; rotate both together |
+| `LITELLM_DB_*` | Read spend logs from the gateway database | Portal app env | Cloudron (addon) | Postgres credentials for the gateway's database |
+| `MATRIX_BOT_TOKEN` | `@inference-bot:inference.coop` admin account: invites, space membership | Portal app env | GM | The account has no password; the token is the only credential |
+| `LOOMIO_API_KEY`, `LOOMIO_B3_KEY` | Forum (Loomio) membership sync | Portal app env | GM | |
+| `LISTMONK_API_USER`, `LISTMONK_API_TOKEN` | Newsletter list sync | Portal app env | GM | |
+| `OWUI_API_KEY`, `OWUI_JWT_SECRET` | Open WebUI knowledge refresh and SSO | Portal app env | GM | Chat moved to LibreChat in October; confirm whether still needed, and retire if not |
+| `BROKER_SECRET` | Shared secret between the portal and the member dashboard | Portal and dashboard app env | GM | Held by both; rotate together |
+| `PORTAL_SECRET` | Session signing | Portal app env | GM | |
+| `CLOUDRON_MAIL_SMTP_*` | Outbound mail | Cloudron mail addon | Cloudron | Managed by the platform |
+
+### Gateway (`gateway.inference.coop`)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| `LITELLM_MASTER_KEY` | Gateway admin | `/app/data/.master_key`, exported into the litellm process by `start.sh` | GM | Also held by the portal (above) and the audio keep-alive job |
+| Salt key (`SALT_KEY_FILE`) | Encrypts provider keys stored in the gateway database | `/app/data` | GM | Losing it means re-entering every provider key |
+| `TINFOIL_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `GREENPT_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `REGOLO_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `CLOUDRON_POSTGRESQL_*`, `CLOUDRON_REDIS_*` | Database and cache | Cloudron addons | Cloudron | Managed by the platform |
+
+### Agent (inferencebot, on the agent VPS)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| Cloudron agent token | Cloudron API | Agent `.env` | GM | See "The two-token split" above |
+| Gitea token | Commits, issues, PRs as `inference-bot` | Agent `.env` | GM | |
+| Matrix access token (`@inferencebot:inference.coop`) | Reading and posting in rooms | Agent host, with its E2EE key store | GM | The off switch in [Working with the agent](working-with-the-agent.md) revokes this second |
+| Gateway virtual key | The agent's own inference | Agent `.env` | GM | Model allowlist and budget live on this key; the off switch revokes it first |
+| Direct provider key (fallback) | Inference during a gateway outage | Agent `.env` | Provider account owner | Planned on co-op/support#17 |
+| LibreChat admin credential | Per-member key sync job | Agent `.env` | GM | Inferred from the job list on #17 |
+| Restic repository passphrase | Nightly encrypted backup of the agent's state | Agent host and the co-op vault | GM | Per #17 |
+| Infomaniak Swiss Backup S3 keys (agent) | Backup target | Agent host | Infomaniak account owner | Per #17 |
+
+### Accounts (not tokens, but the things tokens come from)
+
+| Account | Purpose | Owner today | Notes |
+|---|---|---|---|
+| Cloudron admin (`my.inference.coop`) | Everything on the main server | | |
+| Hostinger | Hosts the main Cloudron server | Personal account (co-op/support#2) | Moving to Infomaniak |
+| Infomaniak | Agent VPS, Swiss Backup S3 for Cloudron and the agent | | S3 keys for Cloudron backups rotated after setup (co-op/support#12) |
+| Open Collective (collective admins) | Dues, webhooks, the personal token above | | |
+| Provider accounts (Tinfoil, GreenPT, Regolo) | Billing and API keys | | |
+| Domain registrar and DNS for `inference.coop` | | | |
+| Gitea, Matrix, Loomio, Listmonk admin accounts | Service administration | | Cloudron SSO where applicable |
+
+### Keeping this current
+
+Add a row when a new integration lands, and strike one when a service is
+retired. A credential held by two apps is the thing most likely to break on
+rotation; the "Notes" column marks each one.