Answer
Credentials are stored as Kubernetes Secrets in the argocd namespace, ideally managed via sealed/external secrets rather than plaintext. Use least-privilege service accounts on target clusters (scoped RBAC), rotate tokens, and consider short-lived credentials (e.g., IRSA/workload identity) instead of long-lived bearer tokens.
Real-world example Target-cluster access uses a scoped service account with only the permissions ArgoCD needs, with tokens rotated regularly.