> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Password Checkout
> Use Password Checkout in Syteca so only one user can use a secret at a time, with optional password rotation on check-in and forced check-in by an Owner.
Password Checkout enhances security by preventing more than one user from using a secret at the same time. While one user has a secret "checked out," no one else can use it. When that user disconnects, the password is returned to the vault and "checked in" again, making the secret available to the next user.
This is valuable when several people share one account: the secret can still only be used by one person at a time, and you can always identify who used it.
This works in the desktop Syteca Connection Manager and, in a similar way, directly from the Management Tool using [Syteca Web Connection Manager](/docs/pam/access/web-connection-manager).
## Before you start
To configure Password Checkout, you need the **Owner** or **Editor** [Role Type](/docs/pam/secrets/permissions) for the secret.
## Configure Password Checkout
On the **Security** tab while [adding](/docs/pam/secrets/add-secret) or editing a secret, set the following options:
| Option | What it does |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Requires check out** | Enables Password Checkout, so only one user can check out the password (and connect to the account) at a time. |
| **Change password on check in** | *(Active Directory, Windows, Unix SSH, and MS SQL only)* Rotates the password every time the secret is checked back in. |
| **Check in automatically after** | Sets a time period after which the password is automatically checked in and the current user is forcibly disconnected. |
| **Force Check In** (button) | Available when editing an existing secret; immediately checks the password in and disconnects the current user. |
To use [File transfer](/docs/pam/secrets/file-transfer) with WinSCP, both **Requires check out** and **Change password on check in** must be selected.
**Change password on check in** is independent of **Enable remote password rotation** (on the Automation tab). Both can be active at once without affecting each other.
**Check in automatically after** is independent of **Allow access without approval during work hours** (on the Just In Time Access tab). If both are active, the user is logged off when the first period expires.
Password Checkout is independent of the [access approval](/docs/pam/secrets/add-secret) functionality (Just In Time Access tab). If both are active, the user must request and receive approval *and* check out the secret before using it.
## View checkout status
You can see the checkout status of every secret in two places:
* On the **Password Management** page's [secrets grid](/docs/pam/secrets/view-manage-secrets), the **Details** column shows the status, with more detail in the tooltip on the **Checked out** icon. Use the **Security** filter (via **More Criteria**) to filter by status.
* In Syteca Connection Manager, the **Details** column shows the same status.
The three statuses are:
| Status | Meaning |
| ------------------------- | ------------------------------------------------------------------------------------------ |
| **Checked out** | Requires checkout is on, and the password is currently checked out (the secret is in use). |
| **Requires checkout** | Requires checkout is on, and the password is checked in (the secret is available). |
| **Checkout not required** | Requires checkout is off (Password Checkout is not enabled for the secret). |
## Related
Configure Password Checkout while creating a secret.
Rotate passwords automatically, independently of check-in.
Requires both checkout options to be enabled.
See checkout status across all secrets.