An approach is described for securely and automatically handling credentials when used for accessing endpoints, and/or applications and resources on the endpoints. The approach involves selecting and injecting credentials at an endpoint by an accessor to log into the endpoint, running applications or gaining access to resources on the endpoint, without full credential information traversing the accessor's machine.