@@ -1068,6 +1068,11 @@ <h4 id="buildpack-lifecycle-object">Buildpack lifecycle object</h4>
 <td><em>string</em></td>
 <td>The root filesystem to use with the buildpack, for example <code class="prettyprint">cflinuxfs4</code></td>
 </tr>
+<tr>
+<td><strong>data.credentials</strong></td>
+<td><em>object</em></td>
+<td>Credentials used to download custom buildpacks from private git repositories, keyed by host. Each entry is a username/password pair. If any buildpack URL embeds credentials, <strong>data.credentials</strong> must be empty; provide credentials in one place only.</td>
+</tr>
 </tbody></table>
 
 <p>For records whose historical lifecycle data is no longer available,
@@ -1121,7 +1126,7 @@ <h4 id="cloud-native-buildpacks-lifecycle-object">Cloud Native Buildpacks lifecy
 <tr>
 <td><strong>data.credentials</strong></td>
 <td><em>object</em></td>
-<td>Credentials used to download the configured buildpacks. This can either contain username/password  or a token.</td>
+<td>Credentials used to download the configured buildpacks, keyed by registry host. Each entry contains either a username/password pair or a token. CNB buildpack URLs must not embed credentials; use <strong>data.credentials</strong> instead.</td>
 </tr>
 <tr>
 <td><strong>data.stack</strong></td>
@@ -11502,6 +11507,16 @@ <h4 id="app-level-configuration"><a name="space-manifest-app-level-configuration
 <td>a) An empty array, which will automatically select the appropriate default buildpack according to the coding language (incompatible with <strong>lifecycle: cnb</strong>) <br>b) An array of one or more URLs pointing to buildpacks <br>c) An array of one or more installed buildpack names <br>Replaces the legacy <code class="prettyprint">buildpack</code> field</td>
 </tr>
 <tr>
+<td><strong>credentials</strong></td>
+<td><em>object</em></td>
+<td>Credentials used to download custom buildpacks (buildpack lifecycle) or buildpack OCI images (cnb lifecycle) from private git repositories or registries, keyed by host. For the buildpack lifecycle each entry is a username/password pair; for the cnb lifecycle each entry is a username/password pair or a token. Set to <code class="prettyprint">null</code> to clear previously stored credentials. If any buildpack URL embeds credentials, <strong>credentials</strong> must be empty; provide credentials in one place only.</td>
+</tr>
+<tr>
+<td><strong>cnb-credentials</strong></td>
+<td><em>object</em></td>
+<td>Backward-compatible alias for <strong>credentials</strong>. Specifying both <strong>credentials</strong> and <strong>cnb-credentials</strong> is an error.</td>
+</tr>
+<tr>
 <td><strong>docker</strong></td>
 <td><em>object</em></td>
 <td>If present, the created app will have Docker lifecycle type; the value of this key is ignored by the API but may be used by clients to source the registry address of the image and credentials, if needed; the <a href="#generate-a-manifest-for-an-app">generate manifest endpoint</a> will return the registry address of the image and username provided with this key</td>