The credential type can be any string, but this sets a vague precedent for "[type].[subtype]". For example, if we decided to use a different password hashing algorithm (ROT13, for example), we'd use "password.rot13". Similarly, if we decide to rev API keys to be hashed, we'd use "apikey.v2"