# Aembit Secrets Operator now supports more credential types

**Aembit Secrets Operator 1.32.322** is now available.

[Secrets Operator](/user-guide/deploy-install/kubernetes/aso/) now retrieves any credential type your Access Policy issues—not just HashiCorp Vault tokens. A new `credentialType` field on the `AembitSecretRefreshSchedule` resource selects which Credential Provider type Aembit uses, and the managed Kubernetes Secret mirrors the Aembit Edge API credentials response for that provider.

* **New `credentialType` field**: Choose `OAuthToken` (the default), `ApiKey`, `UsernamePassword`, `AwsStsFederation`, or `GoogleWorkloadIdentityFederation`. Each type writes its own Secret data keys—for example, `UsernamePassword` produces `username` and `password`, and `AwsStsFederation` produces `awsAccessKeyId`, `awsSecretAccessKey`, and `awsSessionToken`. See [Credential types and Secret data keys](/user-guide/deploy-install/kubernetes/aso/reference/#credential-types-and-secret-data-keys).
* **Backward compatible**: Schedules that omit `credentialType` keep writing a single `token` key, so existing HashiCorp Vault and cert-manager configurations need no change.
* **Clearer mismatch errors**: When `credentialType` doesn’t match the configured Credential Provider, the schedule reports `Aembit Edge API returned a credentials response with no populated fields` instead of writing a blank Secret.
* **AWS credential redaction**: Secrets Operator redacts the AWS access key, secret access key, and session token values from its debug logs.