What the credential actually is
Some storage providers don’t hand out an independent secret when a new access credential is created. Instead they derive both halves of the key pair from an underlying access token: one half is literally the token’s own identifier, the other half a one-way hash of the token’s value. That derivation happens on the provider’s side, at the moment the credential is created — there is no separate “credential” object there for the token to leave behind. The key pair is only ever a view onto the token; the token is the real thing.
This is a claim about the provider’s side specifically. A credential can still have more than one copy sitting locally — one on the machine using it, one in a secure store — and comparing those two against each other is a different, ordinary kind of check: it shows whether the estate’s own records agree with each other, not whether the provider still holds anything behind them. Two local copies can be identical to each other and still be derived from a token that no longer exists anywhere.
What deletion looks like, and where monitoring has to live
That distinction matters the moment the underlying token is deleted. A stored, independent secret that goes missing usually leaves something to notice: an expiry date that passes, a rotation event, a value that no longer matches what it used to be. A derived credential leaves none of that, because the provider never held a second object for anything to diff against. Deleting the token produces no local error and no expiry warning — only the eventual absence of successful runs, downstream, wherever that credential was being used.
The practical consequence is about where monitoring has to live. Watching the credential itself — its presence, its age, whether it matches a known-good value — catches nothing here, because nothing about the credential changes; it simply stops resolving to anything. The only thing that reliably shows the failure is watching for the outcome the credential enables: did the job that depends on it actually succeed. For a derived credential, that’s the only approach that produces a signal at all.
The night this was found — a backup system’s offsite copy silently missing for five nights running, traced back to exactly this kind of deletion — is told in full in Act 22, Five nights with no offsite.