`citadel.access_key_id`, `citadel.secret_access_key`, `citadel.token`. Just beware that most tools don't support temporary credentials since you need that extra token parameter.