What is standing credential?
In short:A standing credential is a secret that stays valid until someone revokes it, such as a static API key or a long-lived password. It works whether or not the agent needs it right now. That makes it the main thing attackers steal and the main thing agent identity platforms try to remove.
How does it work?
The key is stored in config, an environment variable or a vault and presented on each call. Nothing ties its use to a task or a moment.
What does it look like in practice?
A database password set in an agent's environment file two years ago and never rotated.