No, not for application or system accounts that can be used for interactive login. PCI DSS 8.6.2 says their passwords or passphrases must not be hard coded in scripts, configuration or property files, or bespoke and custom source code. Stored passwords must also be encrypted per 8.3.2. This is not legal advice.
Definitions
Hard coded: a secret written into code, a script or a config file that is committed or deployed with it.
Application or system account: a non-human identity used by software, such as a service account.
Interactive login: a login where someone can sign in as that account, as opposed to a purely automated function.
What the text says
8.6.2 sits beside two related items. 8.6.1 says if such accounts can be used interactively, interactive use is prevented unless needed for an exceptional circumstance, limited to the time needed, justified, approved by management, and every action is attributable to an individual. 8.6.3 requires these passwords to be changed periodically, at a frequency set by your targeted risk analysis, and on suspicion of compromise.
The SAQ D notes say these were recommended practices until 31 March 2025 and are required for assessment after that date.
What to use instead
| Approach | Notes |
|---|---|
| Secrets manager with runtime fetch | Rotate in one place, keep code clean |
| Environment injection by the platform | Better than files, but check where it leaks into logs |
| Short-lived credentials | Reduce the value of any leak |
| Remove interactive capability from the account | Narrows what 8.6.1 and 8.6.2 apply to |
Checklist
- Search repositories, scripts and config for credentials, including history.
- Rotate anything you find, since removing it from the latest commit does not undo exposure.
- Move secrets to a store with access control and audit logs.
- Set a rotation schedule tied to your risk analysis under 12.3.1.
- Add a check to the pull request flow so it does not return.
Quick check
Does 8.6.2 apply to API keys?
The text is about passwords and passphrases for accounts that can be used for interactive login. Treat other secrets with the same care and confirm scope with your assessor.
Is an encrypted password in a config file fine?
8.6.2 still says not hard coded in configuration files for those accounts. Encryption is the 8.3.2 expectation for stored passwords, not a way around 8.6.2.
On Safeguard: policies and gates can block a merge on a failing check, and agent identity manages credentials for AI agents. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
