From 145cffee9ededa9035976fece367f2665c3fd8d6 Mon Sep 17 00:00:00 2001
From: Jacob Rothstein <hi@jbr.me>
Date: Thu, 12 Oct 2023 16:12:43 -0700
Subject: [PATCH] rename hpke configs to collector credential everywhere

---
 app/src/ApiClient.ts                          |  50 +-
 app/src/accounts/AccountSummary.tsx           |   2 +-
 .../NextSteps/InlineCollectorCredentials.tsx  |  21 +-
 app/src/accounts/NextSteps/index.tsx          |  34 +-
 app/src/accounts/index.tsx                    |   3 +-
 .../CollectorCredentialForm.tsx}              |  14 +-
 .../CollectorCredentialList.tsx}              |  68 +-
 .../index.tsx                                 |  18 +-
 app/src/router.tsx                            |   4 +-
 .../tasks/TaskDetail/TaskPropertyTable.tsx    |  14 +-
 .../TaskForm/CollectorCredentialSelect.tsx    |  54 ++
 app/src/tasks/TaskForm/HelpText.tsx           |   2 +-
 app/src/tasks/TaskForm/HpkeConfigSelect.tsx   |  50 --
 app/src/tasks/TaskForm/index.tsx              |   6 +-
 app/src/tasks/index.tsx                       |   8 +-
 ...ke_configs.rs => collector_credentials.rs} |  34 +-
 cli/src/main.rs                               |   8 +-
 cli/src/tasks.rs                              |   6 +-
 ...ke_configs.rs => collector_credentials.rs} |   6 +-
 client/src/lib.rs                             |  37 +-
 client/src/task.rs                            |   4 +-
 client/tests/collector_credentials.rs         |  66 ++
 client/tests/hpke_configs.rs                  |  58 --
 client/tests/tasks.rs                         |   4 +-
 documentation/openapi.yml                     |  32 +-
 migration/src/lib.rs                          |   2 +
 ...e_hpke_configs_to_collector_credentials.rs |  67 ++
 src/clients/aggregator_client/api_types.rs    |   2 +-
 src/entity.rs                                 |   8 +-
 src/entity/account.rs                         |  10 +-
 ...hpke_config.rs => collector_credential.rs} |  47 +-
 src/entity/task.rs                            |  16 +-
 src/entity/task/new_task.rs                   |  31 +-
 src/entity/task/provisionable_task.rs         |   6 +-
 src/routes.rs                                 |  21 +-
 src/routes/collector_credentials.rs           |  85 +++
 src/routes/hpke_configs.rs                    |  69 --
 test-support/src/fixtures.rs                  |   8 +-
 test-support/src/lib.rs                       |   4 +-
 tests/collector_credentials.rs                | 686 ++++++++++++++++++
 tests/hpke_configs.rs                         | 550 --------------
 tests/tasks.rs                                |  34 +-
 42 files changed, 1273 insertions(+), 976 deletions(-)
 rename app/src/{hpke-configs/HpkeConfigForm.tsx => collector-credentials/CollectorCredentialForm.tsx} (88%)
 rename app/src/{hpke-configs/HpkeConfigList.tsx => collector-credentials/CollectorCredentialList.tsx} (71%)
 rename app/src/{hpke-configs => collector-credentials}/index.tsx (74%)
 create mode 100644 app/src/tasks/TaskForm/CollectorCredentialSelect.tsx
 delete mode 100644 app/src/tasks/TaskForm/HpkeConfigSelect.tsx
 rename cli/src/{hpke_configs.rs => collector_credentials.rs} (80%)
 rename client/src/{hpke_configs.rs => collector_credentials.rs} (83%)
 create mode 100644 client/tests/collector_credentials.rs
 delete mode 100644 client/tests/hpke_configs.rs
 create mode 100644 migration/src/m20231012_225001_rename_hpke_configs_to_collector_credentials.rs
 rename src/entity/{hpke_config.rs => collector_credential.rs} (73%)
 create mode 100644 src/routes/collector_credentials.rs
 delete mode 100644 src/routes/hpke_configs.rs
 create mode 100644 tests/collector_credentials.rs
 delete mode 100644 tests/hpke_configs.rs

diff --git a/app/src/ApiClient.ts b/app/src/ApiClient.ts
index 8b931c99..cf77f317 100644
--- a/app/src/ApiClient.ts
+++ b/app/src/ApiClient.ts
@@ -74,7 +74,7 @@ export interface Task {
   max_batch_size: number | null;
   report_count: number;
   aggregate_collection_count: number;
-  hpke_config_id: string;
+  collector_credential_id: string;
 }
 
 export interface CollectorAuthToken {
@@ -153,7 +153,7 @@ export interface ApiToken {
   last_used_at?: string;
 }
 
-export interface HpkeConfig {
+export interface CollectorCredential {
   id: string;
   contents: {
     id: number;
@@ -436,35 +436,45 @@ export class ApiClient {
     return res.data as QueueJob;
   }
 
-  async deleteHpkeConfig(hpkeConfigId: string) {
-    await this.delete(`/api/hpke_configs/${hpkeConfigId}`);
+  async deleteCollectorCredential(collectorCredentialId: string) {
+    await this.delete(`/api/collector_credentials/${collectorCredentialId}`);
     return null;
   }
 
-  async updateHpkeConfig(hpkeConfigId: string, hpkeConfig: { name: string }) {
-    await this.patch(`/api/hpke_configs/${hpkeConfigId}`, hpkeConfig);
+  async updateCollectorCredential(
+    collectorCredentialId: string,
+    collectorCredential: { name: string },
+  ) {
+    await this.patch(
+      `/api/collector_credentials/${collectorCredentialId}`,
+      collectorCredential,
+    );
     return null;
   }
 
-  async hpkeConfig(hpkeConfigId: string): Promise<HpkeConfig> {
-    const res = await this.get(`/api/hpke_configs/${hpkeConfigId}`);
-    return res.data as HpkeConfig;
+  async collectorCredential(
+    collectorCredentialId: string,
+  ): Promise<CollectorCredential> {
+    const res = await this.get(
+      `/api/collector_credentials/${collectorCredentialId}`,
+    );
+    return res.data as CollectorCredential;
   }
 
-  async createHpkeConfig(
+  async createCollectorCredential(
     accountId: string,
-    hpkeConfig: { contents: string; name: string },
+    collectorCredential: { contents: string; name: string },
   ): Promise<
-    | HpkeConfig
+    | CollectorCredential
     | { error: ValidationErrorsFor<{ contents: string; name: string }> }
   > {
     const res = await this.post(
-      `/api/accounts/${accountId}/hpke_configs`,
-      hpkeConfig,
+      `/api/accounts/${accountId}/collector_credentials`,
+      collectorCredential,
     );
     switch (res.status) {
       case 201:
-        return res.data as HpkeConfig;
+        return res.data as CollectorCredential;
       case 400:
         return { error: res.data } as {
           error: ValidationErrorsFor<{ contents: string; name: string }>;
@@ -474,9 +484,13 @@ export class ApiClient {
     }
   }
 
-  async accountHpkeConfigs(accountId: string): Promise<HpkeConfig[]> {
-    const res = await this.get(`/api/accounts/${accountId}/hpke_configs`);
-    return res.data as HpkeConfig[];
+  async accountCollectorCredentials(
+    accountId: string,
+  ): Promise<CollectorCredential[]> {
+    const res = await this.get(
+      `/api/accounts/${accountId}/collector_credentials`,
+    );
+    return res.data as CollectorCredential[];
   }
 }
 
diff --git a/app/src/accounts/AccountSummary.tsx b/app/src/accounts/AccountSummary.tsx
index 5c16d939..e9f0a18d 100644
--- a/app/src/accounts/AccountSummary.tsx
+++ b/app/src/accounts/AccountSummary.tsx
@@ -170,7 +170,7 @@ export default function AccountSummary() {
                 </ListGroup.Item>
               </LinkContainer>
 
-              <LinkContainer to="hpke_configs">
+              <LinkContainer to="collector_credentials">
                 <ListGroup.Item action>
                   <KeyFill /> HPKE Configs
                 </ListGroup.Item>
diff --git a/app/src/accounts/NextSteps/InlineCollectorCredentials.tsx b/app/src/accounts/NextSteps/InlineCollectorCredentials.tsx
index ea752f0a..38c04d13 100644
--- a/app/src/accounts/NextSteps/InlineCollectorCredentials.tsx
+++ b/app/src/accounts/NextSteps/InlineCollectorCredentials.tsx
@@ -57,24 +57,27 @@ function SaveApiToken({ onToken }: { onToken: (token: string) => void }) {
 export default function InlineCollectorCredentials() {
   const apiClient = React.useContext(ApiClientContext);
   const { accountId } = useParams() as { accountId: string };
-  const [anyHpkeConfigs, setAnyHpkeConfigs] = React.useState(false);
+  const [anyCollectorCredentials, setAnyCollectorCredentials] =
+    React.useState(false);
   const [inFlight, setInFlight] = React.useState(false);
   useInterval(
     React.useCallback(() => {
-      if (inFlight || anyHpkeConfigs) return;
+      if (inFlight || anyCollectorCredentials) return;
       setInFlight(true);
-      apiClient.accountHpkeConfigs(accountId).then((hpkeConfigs) => {
-        setAnyHpkeConfigs(hpkeConfigs.length > 0);
-        setInFlight(false);
-      });
-    }, [apiClient, setInFlight, setAnyHpkeConfigs]),
+      apiClient
+        .accountCollectorCredentials(accountId)
+        .then((collectorCredentials) => {
+          setAnyCollectorCredentials(collectorCredentials.length > 0);
+          setInFlight(false);
+        });
+    }, [apiClient, setInFlight, setAnyCollectorCredentials]),
     1000,
   );
 
   const [token, setToken] = React.useState<string>("«TOKEN»");
   const { revalidate, state } = useRevalidator();
 
-  if (anyHpkeConfigs) {
+  if (anyCollectorCredentials) {
     return (
       <>
         <h1>Success</h1>
@@ -84,7 +87,7 @@ export default function InlineCollectorCredentials() {
       </>
     );
   } else {
-    const command = `divviup -t ${token} hpke-config generate`;
+    const command = `divviup -t ${token} collector-credential generate`;
     return (
       <>
         <ol className="list-unstyled">
diff --git a/app/src/accounts/NextSteps/index.tsx b/app/src/accounts/NextSteps/index.tsx
index 48d55661..958daf11 100644
--- a/app/src/accounts/NextSteps/index.tsx
+++ b/app/src/accounts/NextSteps/index.tsx
@@ -1,7 +1,12 @@
 import { Steps } from "primereact/steps";
 import { Button, Card, Col, Row } from "react-bootstrap";
 import { useLoaderData } from "react-router-dom";
-import { Account, Aggregator, HpkeConfig, Task } from "../../ApiClient";
+import {
+  Account,
+  Aggregator,
+  CollectorCredential,
+  Task,
+} from "../../ApiClient";
 import { LinkContainer } from "react-router-bootstrap";
 import AggregatorTypeSelection from "./AggregatorTypeSelection";
 import InlineCollectorCredentials from "./InlineCollectorCredentials";
@@ -17,20 +22,20 @@ const STEPS = [
 
 function determineModel({
   account,
-  hpkeConfigs,
+  collectorCredentials,
   aggregators,
 }: {
   account: Account;
-  hpkeConfigs: HpkeConfig[];
+  collectorCredentials: CollectorCredential[];
   aggregators: Aggregator[];
 }): number {
   const aggregatorStepComplete =
     account.intends_to_use_shared_aggregators === true ||
     !!aggregators.find((a) => !!a.account_id);
-  const hpkeConfigStepComplete = hpkeConfigs.length > 0;
+  const collectorCredentialStepComplete = collectorCredentials.length > 0;
 
   const nextStepIndex =
-    [aggregatorStepComplete, hpkeConfigStepComplete, false].findIndex(
+    [aggregatorStepComplete, collectorCredentialStepComplete, false].findIndex(
       (x) => !x,
     ) + 1;
 
@@ -50,18 +55,19 @@ function NextInner({ activeIndex }: { activeIndex: number | undefined }) {
 }
 
 export default function NextSteps() {
-  const { account, hpkeConfigs, aggregators, tasks } = useLoaderData() as {
-    account: Promise<Account>;
-    hpkeConfigs: Promise<HpkeConfig[]>;
-    aggregators: Promise<Aggregator[]>;
-    tasks: Promise<Task[]>;
-  };
+  const { account, collectorCredentials, aggregators, tasks } =
+    useLoaderData() as {
+      account: Promise<Account>;
+      collectorCredentials: Promise<CollectorCredential[]>;
+      aggregators: Promise<Aggregator[]>;
+      tasks: Promise<Task[]>;
+    };
 
   const loadedTasks = usePromise(tasks, []);
   const activeIndex = usePromiseAll(
-    [account, hpkeConfigs, aggregators],
-    ([account, hpkeConfigs, aggregators]) =>
-      determineModel({ account, hpkeConfigs, aggregators }),
+    [account, collectorCredentials, aggregators],
+    ([account, collectorCredentials, aggregators]) =>
+      determineModel({ account, collectorCredentials, aggregators }),
     1,
   );
 
diff --git a/app/src/accounts/index.tsx b/app/src/accounts/index.tsx
index 799e7b26..c80cefab 100644
--- a/app/src/accounts/index.tsx
+++ b/app/src/accounts/index.tsx
@@ -81,7 +81,8 @@ export default function accounts(
               return defer({
                 apiTokens: apiClient.accountApiTokens(accountId),
                 tasks: apiClient.accountTasks(accountId),
-                hpkeConfigs: apiClient.accountHpkeConfigs(accountId),
+                collectorCredentials:
+                  apiClient.accountCollectorCredentials(accountId),
                 aggregators: apiClient.accountAggregators(accountId),
                 account: apiClient.account(accountId),
               });
diff --git a/app/src/hpke-configs/HpkeConfigForm.tsx b/app/src/collector-credentials/CollectorCredentialForm.tsx
similarity index 88%
rename from app/src/hpke-configs/HpkeConfigForm.tsx
rename to app/src/collector-credentials/CollectorCredentialForm.tsx
index 5a24e45a..cba1adeb 100644
--- a/app/src/hpke-configs/HpkeConfigForm.tsx
+++ b/app/src/collector-credentials/CollectorCredentialForm.tsx
@@ -16,19 +16,19 @@ import { KeyFill } from "react-bootstrap-icons";
 import { useFetcher } from "react-router-dom";
 import { formikErrors } from "../ApiClient";
 
-export default function HpkeConfigForm() {
+export default function CollectorCredentialForm() {
   const fetcher = useFetcher();
   const [name, setName] = React.useState("");
-  const [hpke, setHpke] = React.useState("");
+  const [collectorCredential, setCollectorCredential] = React.useState("");
   const reader = React.useMemo(() => {
     const reader = new FileReader();
     reader.addEventListener("load", () => {
       if (typeof reader.result === "string") {
-        setHpke(reader.result.split(",")[1]);
+        setCollectorCredential(reader.result.split(",")[1]);
       }
     });
     return reader;
-  }, [setHpke]);
+  }, [setCollectorCredential]);
   const onChange: ChangeEventHandler<HTMLInputElement> = React.useCallback(
     (event) => {
       const files = event.target.files;
@@ -44,12 +44,12 @@ export default function HpkeConfigForm() {
   useEffect(() => {
     if (typeof fetcher.data === "object" && !("error" in fetcher.data)) {
       setName("");
-      setHpke("");
+      setCollectorCredential("");
       if (ref.current) {
         ref.current.value = "";
       }
     }
-  }, [fetcher, setName, setHpke, ref]);
+  }, [fetcher, setName, setCollectorCredential, ref]);
 
   const errors = formikErrors<{ contents?: string; name?: string }>(
     fetcher.data && "error" in fetcher.data
@@ -97,7 +97,7 @@ export default function HpkeConfigForm() {
               </FormControl.Feedback>
             ) : null}
           </FormGroup>
-          <input type="hidden" name="contents" value={hpke} />
+          <input type="hidden" name="contents" value={collectorCredential} />
         </Col>
         <Col sm="2">
           <FormGroup controlId="submit" className="my-3">
diff --git a/app/src/hpke-configs/HpkeConfigList.tsx b/app/src/collector-credentials/CollectorCredentialList.tsx
similarity index 71%
rename from app/src/hpke-configs/HpkeConfigList.tsx
rename to app/src/collector-credentials/CollectorCredentialList.tsx
index 45be9f47..34d9a7b1 100644
--- a/app/src/hpke-configs/HpkeConfigList.tsx
+++ b/app/src/collector-credentials/CollectorCredentialList.tsx
@@ -11,7 +11,7 @@ import {
   useLoaderData,
   useNavigation,
 } from "react-router-dom";
-import { HpkeConfig } from "../ApiClient";
+import { CollectorCredential } from "../ApiClient";
 import Table from "react-bootstrap/Table";
 import React from "react";
 import { DateTime } from "luxon";
@@ -20,9 +20,9 @@ import FormGroup from "react-bootstrap/FormGroup";
 import InputGroup from "react-bootstrap/InputGroup";
 import Modal from "react-bootstrap/Modal";
 import Placeholder from "react-bootstrap/Placeholder";
-import HpkeConfigForm from "./HpkeConfigForm";
+import CollectorCredentialForm from "./CollectorCredentialForm";
 
-export default function HpkeConfigs() {
+export default function CollectorCredentials() {
   return (
     <>
       <Breadcrumbs />
@@ -39,12 +39,12 @@ export default function HpkeConfigs() {
       </Row>
       <Row className="mb-3">
         <Col>
-          <HpkeConfigForm />
+          <CollectorCredentialForm />
         </Col>
       </Row>
       <Row>
         <Col>
-          <HpkeConfigList />
+          <CollectorCredentialList />
         </Col>
       </Row>
     </>
@@ -59,9 +59,9 @@ function Breadcrumbs() {
   );
 }
 
-function HpkeConfigList() {
-  const { hpkeConfigs } = useLoaderData() as {
-    hpkeConfigs: Promise<HpkeConfig[]>;
+function CollectorCredentialList() {
+  const { collectorCredentials } = useLoaderData() as {
+    collectorCredentials: Promise<CollectorCredential[]>;
   };
 
   return (
@@ -78,10 +78,13 @@ function HpkeConfigList() {
       </thead>
       <tbody>
         <Suspense>
-          <Await resolve={hpkeConfigs}>
-            {(hpkeConfigs: HpkeConfig[]) =>
-              hpkeConfigs.map((hpkeConfig) => (
-                <HpkeConfigRow key={hpkeConfig.id} hpkeConfig={hpkeConfig} />
+          <Await resolve={collectorCredentials}>
+            {(collectorCredentials: CollectorCredential[]) =>
+              collectorCredentials.map((collectorCredential) => (
+                <CollectorCredentialRow
+                  key={collectorCredential.id}
+                  collectorCredential={collectorCredential}
+                />
               ))
             }
           </Await>
@@ -91,7 +94,11 @@ function HpkeConfigList() {
   );
 }
 
-function Name({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
+function Name({
+  collectorCredential,
+}: {
+  collectorCredential: CollectorCredential;
+}) {
   const [isEditing, setEditing] = useState(false);
   const edit = useCallback(() => setEditing(true), [setEditing]);
   const fetcher = useFetcher();
@@ -100,13 +107,13 @@ function Name({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
   }, [fetcher, setEditing]);
   if (isEditing) {
     return (
-      <fetcher.Form action={hpkeConfig.id} method="patch">
+      <fetcher.Form action={collectorCredential.id} method="patch">
         <FormGroup>
           <InputGroup>
             <FormControl
               type="text"
               name="name"
-              defaultValue={hpkeConfig.name || ""}
+              defaultValue={collectorCredential.name || ""}
               data-1p-ignore
               autoFocus
             />
@@ -120,7 +127,8 @@ function Name({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
   } else {
     return (
       <span onClick={edit}>
-        {hpkeConfig.name || `HPKE Config ${hpkeConfig.contents.id}`}{" "}
+        {collectorCredential.name ||
+          `HPKE Config ${collectorCredential.contents.id}`}{" "}
         <Button
           variant="outline-secondary"
           onClick={edit}
@@ -144,7 +152,11 @@ function RelativeTime({ time, missing }: { time?: string; missing?: string }) {
   );
 }
 
-function DeleteButton({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
+function DeleteButton({
+  collectorCredential,
+}: {
+  collectorCredential: CollectorCredential;
+}) {
   const navigation = useNavigation();
 
   const [show, setShow] = useState(false);
@@ -169,7 +181,7 @@ function DeleteButton({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
       <Modal show={show} onHide={close}>
         <Modal.Header closeButton>
           <Modal.Title>
-            Confirm HPKE Config Deletion {hpkeConfig.name}
+            Confirm HPKE Config Deletion {collectorCredential.name}
           </Modal.Title>
         </Modal.Header>
         <Modal.Body>
@@ -180,7 +192,7 @@ function DeleteButton({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
           <Button variant="secondary" onClick={close}>
             Close
           </Button>
-          <fetcher.Form method="delete" action={hpkeConfig.id}>
+          <fetcher.Form method="delete" action={collectorCredential.id}>
             <Button
               variant="danger"
               type="submit"
@@ -195,20 +207,24 @@ function DeleteButton({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
   );
 }
 
-function HpkeConfigRow({ hpkeConfig }: { hpkeConfig: HpkeConfig }) {
+function CollectorCredentialRow({
+  collectorCredential,
+}: {
+  collectorCredential: CollectorCredential;
+}) {
   return (
     <tr>
       <td>
-        <Name hpkeConfig={hpkeConfig} />
+        <Name collectorCredential={collectorCredential} />
       </td>
-      <td>{hpkeConfig.contents.kem_id}</td>
-      <td>{hpkeConfig.contents.kdf_id}</td>
-      <td>{hpkeConfig.contents.aead_id}</td>
+      <td>{collectorCredential.contents.kem_id}</td>
+      <td>{collectorCredential.contents.kdf_id}</td>
+      <td>{collectorCredential.contents.aead_id}</td>
       <td>
-        <RelativeTime time={hpkeConfig.created_at} />
+        <RelativeTime time={collectorCredential.created_at} />
       </td>
       <td>
-        <DeleteButton hpkeConfig={hpkeConfig} />
+        <DeleteButton collectorCredential={collectorCredential} />
       </td>
     </tr>
   );
diff --git a/app/src/hpke-configs/index.tsx b/app/src/collector-credentials/index.tsx
similarity index 74%
rename from app/src/hpke-configs/index.tsx
rename to app/src/collector-credentials/index.tsx
index 5924de0f..52d853c9 100644
--- a/app/src/hpke-configs/index.tsx
+++ b/app/src/collector-credentials/index.tsx
@@ -1,23 +1,23 @@
 import { RouteObject, defer } from "react-router-dom";
 import ApiClient from "../ApiClient";
-import HpkeConfigList from "./HpkeConfigList";
+import CollectorCredentialList from "./CollectorCredentialList";
 export default function apiTokens(apiClient: ApiClient): RouteObject {
   return {
-    path: "hpke_configs",
+    path: "collector_credentials",
     children: [
       {
         path: "",
         index: true,
-        element: <HpkeConfigList />,
+        element: <CollectorCredentialList />,
         loader({ params }) {
           return defer({
-            hpkeConfigs: apiClient.accountHpkeConfigs(
+            collectorCredentials: apiClient.accountCollectorCredentials(
               params.accountId as string,
             ),
           });
         },
 
-        id: "hpkeConfigs",
+        id: "collectorCredentials",
 
         shouldRevalidate(_) {
           return true;
@@ -26,7 +26,7 @@ export default function apiTokens(apiClient: ApiClient): RouteObject {
         async action({ params, request }) {
           switch (request.method) {
             case "POST":
-              return await apiClient.createHpkeConfig(
+              return await apiClient.createCollectorCredential(
                 params.accountId as string,
                 Object.fromEntries(await request.formData()) as {
                   name: string;
@@ -44,7 +44,7 @@ export default function apiTokens(apiClient: ApiClient): RouteObject {
         async action({ params, request }) {
           switch (request.method) {
             case "PATCH":
-              await apiClient.updateHpkeConfig(
+              await apiClient.updateCollectorCredential(
                 params.apiTokenId as string,
                 Object.fromEntries(await request.formData()) as {
                   name: string;
@@ -52,7 +52,9 @@ export default function apiTokens(apiClient: ApiClient): RouteObject {
               );
               return true;
             case "DELETE":
-              await apiClient.deleteHpkeConfig(params.apiTokenId as string);
+              await apiClient.deleteCollectorCredential(
+                params.apiTokenId as string,
+              );
               return true;
             default:
               throw new Error(`unexpected method ${request.method}`);
diff --git a/app/src/router.tsx b/app/src/router.tsx
index 250844ea..f269d165 100644
--- a/app/src/router.tsx
+++ b/app/src/router.tsx
@@ -17,7 +17,7 @@ import aggregators from "./aggregators";
 import { Spinner } from "react-bootstrap";
 import queue from "./queue";
 import sharedAggregators from "./shared-aggregators";
-import hpkeConfigs from "./hpke-configs";
+import collectorCredentials from "./collector-credentials";
 import swaggerUi from "./swagger-ui";
 
 function buildRouter(apiClient: ApiClient) {
@@ -32,7 +32,7 @@ function buildRouter(apiClient: ApiClient) {
         apiTokens(apiClient),
         memberships(apiClient),
         tasks(apiClient),
-        hpkeConfigs(apiClient),
+        collectorCredentials(apiClient),
       ]),
     ]),
   ]);
diff --git a/app/src/tasks/TaskDetail/TaskPropertyTable.tsx b/app/src/tasks/TaskDetail/TaskPropertyTable.tsx
index 4c4f9537..17e51d9e 100644
--- a/app/src/tasks/TaskDetail/TaskPropertyTable.tsx
+++ b/app/src/tasks/TaskDetail/TaskPropertyTable.tsx
@@ -1,7 +1,7 @@
 import { Await, useParams, useLoaderData, Link } from "react-router-dom";
 import Col from "react-bootstrap/Col";
 import { Suspense } from "react";
-import { Task, Aggregator, HpkeConfig } from "../../ApiClient";
+import { Task, Aggregator, CollectorCredential } from "../../ApiClient";
 import humanizeDuration from "humanize-duration";
 import Card from "react-bootstrap/Card";
 import ListGroup from "react-bootstrap/ListGroup";
@@ -12,12 +12,12 @@ import Vdaf from "./Vdaf";
 
 export default function TaskPropertyTable() {
   const { accountId } = useParams();
-  const { task, leaderAggregator, helperAggregator, hpkeConfig } =
+  const { task, leaderAggregator, helperAggregator, collectorCredential } =
     useLoaderData() as {
       task: Promise<Task>;
       leaderAggregator: Promise<Aggregator>;
       helperAggregator: Promise<Aggregator>;
-      hpkeConfig: Promise<HpkeConfig>;
+      collectorCredential: Promise<CollectorCredential>;
     };
 
   return (
@@ -119,10 +119,10 @@ export default function TaskPropertyTable() {
           <ListGroup.Item>
             HPKE Config:{" "}
             <Suspense fallback={<Placeholder animation="glow" xs={6} />}>
-              <Await resolve={hpkeConfig}>
-                {(hpkeConfig) => (
-                  <Link to={`/accounts/${accountId}/hpke_configs`}>
-                    {hpkeConfig.name}
+              <Await resolve={collectorCredential}>
+                {(collectorCredential) => (
+                  <Link to={`/accounts/${accountId}/collector_credentials`}>
+                    {collectorCredential.name}
                   </Link>
                 )}
               </Await>
diff --git a/app/src/tasks/TaskForm/CollectorCredentialSelect.tsx b/app/src/tasks/TaskForm/CollectorCredentialSelect.tsx
new file mode 100644
index 00000000..9c37a261
--- /dev/null
+++ b/app/src/tasks/TaskForm/CollectorCredentialSelect.tsx
@@ -0,0 +1,54 @@
+import { Await, useLoaderData } from "react-router-dom";
+import FormControl from "react-bootstrap/FormControl";
+import FormSelect from "react-bootstrap/FormSelect";
+import React, { Suspense } from "react";
+import { CollectorCredential } from "../../ApiClient";
+import { Props, TaskFormGroup } from ".";
+import { ShortHelpAndLabel } from "./HelpText";
+
+export default function CollectorCredentialSelect(props: Props) {
+  const { collectorCredentials } = useLoaderData() as {
+    collectorCredentials: Promise<CollectorCredential[]>;
+  };
+  const { setFieldValue } = props;
+
+  React.useEffect(() => {
+    collectorCredentials.then((configs) => {
+      if (configs.length === 1)
+        setFieldValue("collector_credential_id", configs[0].id);
+    });
+  }, [collectorCredentials, setFieldValue]);
+
+  return (
+    <TaskFormGroup controlId="collector_credential_id">
+      <ShortHelpAndLabel
+        fieldKey="collector_credential_id"
+        setFocusedField={props.setFocusedField}
+      />
+      <FormSelect
+        isInvalid={!!props.errors.collector_credential_id}
+        id="collector-credential-id"
+        name="collector_credential_id"
+      >
+        <option disabled></option>
+        <Suspense fallback={<option disabled>...</option>}>
+          <Await resolve={collectorCredentials}>
+            {(collectorCredentials: CollectorCredential[]) =>
+              collectorCredentials.map((collectorCredential) => (
+                <option
+                  key={collectorCredential.id}
+                  value={collectorCredential.id}
+                >
+                  {collectorCredential.name}
+                </option>
+              ))
+            }
+          </Await>
+        </Suspense>
+      </FormSelect>
+      <FormControl.Feedback type="invalid">
+        {props.errors.collector_credential_id}
+      </FormControl.Feedback>
+    </TaskFormGroup>
+  );
+}
diff --git a/app/src/tasks/TaskForm/HelpText.tsx b/app/src/tasks/TaskForm/HelpText.tsx
index 671a3117..5450a35e 100644
--- a/app/src/tasks/TaskForm/HelpText.tsx
+++ b/app/src/tasks/TaskForm/HelpText.tsx
@@ -150,7 +150,7 @@ export const HELPS: {
     ),
   },
 
-  hpke_config_id: {
+  collector_credential_id: {
     title: "Collector HPKE Config",
     short:
       "The collector's HPKE config. Results will be encrypted using the config's public key.",
diff --git a/app/src/tasks/TaskForm/HpkeConfigSelect.tsx b/app/src/tasks/TaskForm/HpkeConfigSelect.tsx
deleted file mode 100644
index 0360286a..00000000
--- a/app/src/tasks/TaskForm/HpkeConfigSelect.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import { Await, useLoaderData } from "react-router-dom";
-import FormControl from "react-bootstrap/FormControl";
-import FormSelect from "react-bootstrap/FormSelect";
-import React, { Suspense } from "react";
-import { HpkeConfig } from "../../ApiClient";
-import { Props, TaskFormGroup } from ".";
-import { ShortHelpAndLabel } from "./HelpText";
-
-export default function HpkeConfigSelect(props: Props) {
-  const { hpkeConfigs } = useLoaderData() as {
-    hpkeConfigs: Promise<HpkeConfig[]>;
-  };
-  const { setFieldValue } = props;
-
-  React.useEffect(() => {
-    hpkeConfigs.then((configs) => {
-      if (configs.length === 1) setFieldValue("hpke_config_id", configs[0].id);
-    });
-  }, [hpkeConfigs, setFieldValue]);
-
-  return (
-    <TaskFormGroup controlId="hpke_config_id">
-      <ShortHelpAndLabel
-        fieldKey="hpke_config_id"
-        setFocusedField={props.setFocusedField}
-      />
-      <FormSelect
-        isInvalid={!!props.errors.hpke_config_id}
-        id="hpke-config-id"
-        name="hpke_config_id"
-      >
-        <option disabled></option>
-        <Suspense fallback={<option disabled>...</option>}>
-          <Await resolve={hpkeConfigs}>
-            {(hpkeConfigs: HpkeConfig[]) =>
-              hpkeConfigs.map((hpkeConfig) => (
-                <option key={hpkeConfig.id} value={hpkeConfig.id}>
-                  {hpkeConfig.name}
-                </option>
-              ))
-            }
-          </Await>
-        </Suspense>
-      </FormSelect>
-      <FormControl.Feedback type="invalid">
-        {props.errors.hpke_config_id}
-      </FormControl.Feedback>
-    </TaskFormGroup>
-  );
-}
diff --git a/app/src/tasks/TaskForm/index.tsx b/app/src/tasks/TaskForm/index.tsx
index d40c07ff..d251d1bf 100644
--- a/app/src/tasks/TaskForm/index.tsx
+++ b/app/src/tasks/TaskForm/index.tsx
@@ -19,7 +19,7 @@ import { AccountBreadcrumbs } from "../../util";
 import LeaderAggregator from "./LeaderAggregator";
 import HelperAggregator from "./HelperAggregator";
 import QueryType from "./QueryType";
-import HpkeConfigSelect from "./HpkeConfigSelect";
+import CollectorCredentialSelect from "./CollectorCredentialSelect";
 import TaskName from "./TaskName";
 import MinBatchSize from "./MinBatchSize";
 import TimePrecisionSeconds from "./TimePrecisionSeconds";
@@ -102,7 +102,7 @@ export default function TaskForm() {
                 name: "",
                 max_batch_size: null,
                 time_precision_seconds: 3600,
-                hpke_config_id: null,
+                collector_credential_id: null,
               } as unknown as NewTask
             }
             onSubmit={handleSubmit}
@@ -125,7 +125,7 @@ export default function TaskForm() {
                   <VdafDetails {...props} />
                   <QueryType {...props} />
                   <MinBatchSize {...props} />
-                  <HpkeConfigSelect {...props} />
+                  <CollectorCredentialSelect {...props} />
                   <TimePrecisionSeconds {...props} />
                   <TaskFormGroup>
                     <Button
diff --git a/app/src/tasks/index.tsx b/app/src/tasks/index.tsx
index 9cbe2916..86d8ae7a 100644
--- a/app/src/tasks/index.tsx
+++ b/app/src/tasks/index.tsx
@@ -29,14 +29,14 @@ export default function tasks(apiClient: ApiClient): RouteObject {
           const helperAggregator = task.then((t) =>
             apiClient.aggregator(t.helper_aggregator_id),
           );
-          const hpkeConfig = task.then((t) =>
-            apiClient.hpkeConfig(t.hpke_config_id),
+          const collectorCredential = task.then((t) =>
+            apiClient.collectorCredential(t.collector_credential_id),
           );
           return defer({
             task,
             leaderAggregator,
             helperAggregator,
-            hpkeConfig,
+            collectorCredential,
           });
         },
 
@@ -73,7 +73,7 @@ export default function tasks(apiClient: ApiClient): RouteObject {
             aggregators: apiClient.accountAggregators(
               params.accountId as string,
             ),
-            hpkeConfigs: apiClient.accountHpkeConfigs(
+            collectorCredentials: apiClient.accountCollectorCredentials(
               params.accountId as string,
             ),
           });
diff --git a/cli/src/hpke_configs.rs b/cli/src/collector_credentials.rs
similarity index 80%
rename from cli/src/hpke_configs.rs
rename to cli/src/collector_credentials.rs
index 44fd72df..89fd7bcc 100644
--- a/cli/src/hpke_configs.rs
+++ b/cli/src/collector_credentials.rs
@@ -1,7 +1,7 @@
 use crate::{CliResult, DetermineAccountId, Error, Output};
 use base64::{engine::general_purpose::STANDARD, Engine};
 use clap::Subcommand;
-use divviup_client::{Decode, DivviupClient, HpkeConfigContents, Uuid};
+use divviup_client::{Decode, DivviupClient, HpkeConfig, Uuid};
 use std::{borrow::Cow, path::PathBuf};
 use trillium_tokio::tokio::fs;
 
@@ -9,7 +9,7 @@ use trillium_tokio::tokio::fs;
 use hpke_dispatch::{Aead, Kdf, Kem};
 
 #[derive(Subcommand, Debug)]
-pub enum HpkeConfigAction {
+pub enum CollectorCredentialAction {
     /// list hpke configs for the target account
     List,
     /// list hpke configs for the target account
@@ -34,7 +34,7 @@ pub enum HpkeConfigAction {
         name: Option<String>,
     },
     /// delete a hpke config by id
-    Delete { hpke_config_id: Uuid },
+    Delete { collector_credential_id: Uuid },
 
     #[cfg(feature = "hpke")]
     /// create a new hpke config and upload the public key to divviup
@@ -67,7 +67,7 @@ pub enum HpkeConfigAction {
     },
 }
 
-impl HpkeConfigAction {
+impl CollectorCredentialAction {
     pub(crate) async fn run(
         self,
         account_id: DetermineAccountId,
@@ -75,12 +75,12 @@ impl HpkeConfigAction {
         output: Output,
     ) -> CliResult {
         match self {
-            HpkeConfigAction::List => {
+            CollectorCredentialAction::List => {
                 let account_id = account_id.await?;
-                output.display(client.hpke_configs(account_id).await?);
+                output.display(client.collector_credentials(account_id).await?);
             }
 
-            HpkeConfigAction::Create { file, base64, name } => {
+            CollectorCredentialAction::Create { file, base64, name } => {
                 let account_id = account_id.await?;
                 let bytes = match (&file, base64) {
                     (Some(path), None) => fs::read(path).await?,
@@ -99,21 +99,25 @@ impl HpkeConfigAction {
                     _ => None,
                 };
 
-                let hpke_config = HpkeConfigContents::get_decoded(&bytes)?;
+                let hpke_config = HpkeConfig::get_decoded(&bytes)?;
 
                 output.display(
                     client
-                        .create_hpke_config(account_id, &hpke_config, name.as_deref())
+                        .create_collector_credential(account_id, &hpke_config, name.as_deref())
                         .await?,
                 );
             }
 
-            HpkeConfigAction::Delete { hpke_config_id } => {
-                client.delete_hpke_config(hpke_config_id).await?;
+            CollectorCredentialAction::Delete {
+                collector_credential_id,
+            } => {
+                client
+                    .delete_collector_credential(collector_credential_id)
+                    .await?;
             }
 
             #[cfg(feature = "hpke")]
-            HpkeConfigAction::Generate {
+            CollectorCredentialAction::Generate {
                 kem,
                 kdf,
                 aead,
@@ -131,7 +135,7 @@ impl HpkeConfigAction {
 
                 let config_id = id.unwrap_or_else(|| rand::random());
 
-                let hpke_config = HpkeConfigContents::new(
+                let hpke_config = HpkeConfig::new(
                     config_id.into(),
                     (kem as u16).try_into().unwrap(),
                     (kdf as u16).try_into().unwrap(),
@@ -139,10 +143,10 @@ impl HpkeConfigAction {
                     public_key.clone().into(),
                 );
 
-                let name = name.unwrap_or_else(|| format!("hpke-config-{config_id}"));
+                let name = name.unwrap_or_else(|| format!("collector-credential-{config_id}"));
                 output.display(
                     client
-                        .create_hpke_config(account_id, &hpke_config, Some(&name))
+                        .create_collector_credential(account_id, &hpke_config, Some(&name))
                         .await?,
                 );
                 output.display(json!({
diff --git a/cli/src/main.rs b/cli/src/main.rs
index 5a2339bc..7e9ea554 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -10,7 +10,7 @@
 mod accounts;
 mod aggregators;
 mod api_tokens;
-mod hpke_configs;
+mod collector_credentials;
 mod memberships;
 mod tasks;
 
@@ -18,10 +18,10 @@ use accounts::AccountAction;
 use aggregators::AggregatorAction;
 use api_tokens::ApiTokenAction;
 use clap::{Parser, Subcommand, ValueEnum};
+use collector_credentials::CollectorCredentialAction;
 use colored::Colorize;
 use const_format::concatcp;
 use divviup_client::{Client, CodecError, DivviupClient, HeaderValue, KnownHeaderName, Url, Uuid};
-use hpke_configs::HpkeConfigAction;
 use memberships::MembershipAction;
 use serde::Serialize;
 use std::{
@@ -124,7 +124,7 @@ enum Resource {
 
     /// manage asymmetrical encryption keys for collecting task aggregates later
     #[command(subcommand)]
-    HpkeConfig(HpkeConfigAction),
+    CollectorCredential(CollectorCredentialAction),
 }
 
 #[derive(thiserror::Error, Debug)]
@@ -215,7 +215,7 @@ impl Resource {
             Resource::Task(action) => action.run(account_id, client, output).await,
             Resource::Aggregator(action) => action.run(account_id, client, output).await,
             Resource::Membership(action) => action.run(account_id, client, output).await,
-            Resource::HpkeConfig(action) => action.run(account_id, client, output).await,
+            Resource::CollectorCredential(action) => action.run(account_id, client, output).await,
         }
     }
 }
diff --git a/cli/src/tasks.rs b/cli/src/tasks.rs
index dc87a324..69f200dc 100644
--- a/cli/src/tasks.rs
+++ b/cli/src/tasks.rs
@@ -34,7 +34,7 @@ pub enum TaskAction {
         #[arg(long)]
         time_precision: Duration,
         #[arg(long)]
-        hpke_config_id: Uuid,
+        collector_credential_id: Uuid,
         #[arg(long, value_delimiter = ',')]
         categorical_buckets: Option<Vec<String>>,
         #[arg(long, value_delimiter = ',')]
@@ -73,7 +73,7 @@ impl TaskAction {
                 min_batch_size,
                 max_batch_size,
                 time_precision,
-                hpke_config_id,
+                collector_credential_id,
                 categorical_buckets,
                 continuous_buckets,
                 length,
@@ -130,7 +130,7 @@ impl TaskAction {
                     min_batch_size,
                     max_batch_size,
                     time_precision_seconds,
-                    hpke_config_id,
+                    collector_credential_id,
                 };
 
                 output.display(client.create_task(account_id, task).await?)
diff --git a/client/src/hpke_configs.rs b/client/src/collector_credentials.rs
similarity index 83%
rename from client/src/hpke_configs.rs
rename to client/src/collector_credentials.rs
index 984b84d9..6812f629 100644
--- a/client/src/hpke_configs.rs
+++ b/client/src/collector_credentials.rs
@@ -1,12 +1,12 @@
-use crate::HpkeConfigContents;
+use crate::HpkeConfig;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use uuid::Uuid;
 
 #[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq)]
-pub struct HpkeConfig {
+pub struct CollectorCredential {
     pub id: Uuid,
-    pub contents: HpkeConfigContents,
+    pub contents: HpkeConfig,
     #[serde(with = "::time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(default, with = "::time::serde::rfc3339::option")]
diff --git a/client/src/lib.rs b/client/src/lib.rs
index 2bf2056e..e1115009 100644
--- a/client/src/lib.rs
+++ b/client/src/lib.rs
@@ -10,7 +10,7 @@
 mod account;
 mod aggregator;
 mod api_token;
-mod hpke_configs;
+mod collector_credentials;
 mod membership;
 mod protocol;
 mod task;
@@ -29,10 +29,10 @@ use trillium_http::{HeaderName, HeaderValues};
 pub use account::Account;
 pub use aggregator::{Aggregator, CollectorAuthenticationToken, NewAggregator, Role};
 pub use api_token::ApiToken;
-pub use hpke_configs::HpkeConfig;
+pub use collector_credentials::CollectorCredential;
 pub use janus_messages::{
     codec::{CodecError, Decode, Encode},
-    HpkeConfig as HpkeConfigContents, HpkePublicKey,
+    HpkeConfig, HpkePublicKey,
 };
 pub use membership::Membership;
 pub use protocol::Protocol;
@@ -304,31 +304,34 @@ impl DivviupClient {
         self.delete(&format!("api/api_tokens/{api_token_id}")).await
     }
 
-    pub async fn hpke_configs(&self, account_id: Uuid) -> ClientResult<Vec<HpkeConfig>> {
-        self.get(&format!("api/accounts/{account_id}/hpke_configs"))
+    pub async fn collector_credentials(
+        &self,
+        account_id: Uuid,
+    ) -> ClientResult<Vec<CollectorCredential>> {
+        self.get(&format!("api/accounts/{account_id}/collector_credentials"))
             .await
     }
 
-    pub async fn rename_hpke_config(
+    pub async fn rename_collector_credential(
         &self,
-        hpke_config_id: Uuid,
+        collector_credential_id: Uuid,
         new_name: &str,
-    ) -> ClientResult<HpkeConfig> {
+    ) -> ClientResult<CollectorCredential> {
         self.patch(
-            &format!("api/hpke_configs/{hpke_config_id}"),
+            &format!("api/collector_credentials/{collector_credential_id}"),
             &json!({"name": new_name}),
         )
         .await
     }
 
-    pub async fn create_hpke_config(
+    pub async fn create_collector_credential(
         &self,
         account_id: Uuid,
-        hpke_config: &HpkeConfigContents,
+        hpke_config: &HpkeConfig,
         name: Option<&str>,
-    ) -> ClientResult<HpkeConfig> {
+    ) -> ClientResult<CollectorCredential> {
         self.post(
-            &format!("api/accounts/{account_id}/hpke_configs"),
+            &format!("api/accounts/{account_id}/collector_credentials"),
             Some(&json!({
                 "name": name,
                 "contents": STANDARD.encode(hpke_config.get_encoded())
@@ -337,9 +340,11 @@ impl DivviupClient {
         .await
     }
 
-    pub async fn delete_hpke_config(&self, hpke_config_id: Uuid) -> ClientResult {
-        self.delete(&format!("api/hpke_configs/{hpke_config_id}"))
-            .await
+    pub async fn delete_collector_credential(&self, collector_credential_id: Uuid) -> ClientResult {
+        self.delete(&format!(
+            "api/collector_credentials/{collector_credential_id}"
+        ))
+        .await
     }
 
     pub async fn shared_aggregators(&self) -> ClientResult<Vec<Aggregator>> {
diff --git a/client/src/task.rs b/client/src/task.rs
index 4ebcf9ab..e78f410d 100644
--- a/client/src/task.rs
+++ b/client/src/task.rs
@@ -21,7 +21,7 @@ pub struct Task {
     pub expiration: Option<OffsetDateTime>,
     pub leader_aggregator_id: Uuid,
     pub helper_aggregator_id: Uuid,
-    pub hpke_config_id: Uuid,
+    pub collector_credential_id: Uuid,
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, Eq, PartialEq)]
@@ -33,7 +33,7 @@ pub struct NewTask {
     pub min_batch_size: u64,
     pub max_batch_size: Option<u64>,
     pub time_precision_seconds: u64,
-    pub hpke_config_id: Uuid,
+    pub collector_credential_id: Uuid,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq)]
diff --git a/client/tests/collector_credentials.rs b/client/tests/collector_credentials.rs
new file mode 100644
index 00000000..a9225eb3
--- /dev/null
+++ b/client/tests/collector_credentials.rs
@@ -0,0 +1,66 @@
+mod harness;
+use divviup_api::api_mocks::aggregator_api::random_hpke_config;
+use divviup_client::DivviupClient;
+use harness::with_configured_client;
+use std::sync::Arc;
+use test_support::{assert_eq, test, *};
+
+#[test(harness = with_configured_client)]
+async fn collector_credentials_list(
+    app: Arc<DivviupApi>,
+    account: Account,
+    client: DivviupClient,
+) -> TestResult {
+    fixtures::collector_credential(&app, &account).await;
+    let collector_credentials = client.collector_credentials(account.id).await?;
+    assert_eq!(collector_credentials.len(), 1);
+    Ok(())
+}
+
+#[test(harness = with_configured_client)]
+async fn create_collector_credential(
+    _app: Arc<DivviupApi>,
+    account: Account,
+    client: DivviupClient,
+) -> TestResult {
+    let config = random_hpke_config();
+    let collector_credential = client
+        .create_collector_credential(account.id, &config, None)
+        .await?;
+    assert_eq!(config, collector_credential.contents);
+    Ok(())
+}
+
+#[test(harness = with_configured_client)]
+async fn create_collector_credential_with_name(
+    _app: Arc<DivviupApi>,
+    account: Account,
+    client: DivviupClient,
+) -> TestResult {
+    let config = random_hpke_config();
+    let name = fixtures::random_name();
+    let collector_credential = client
+        .create_collector_credential(account.id, &config, Some(&name))
+        .await?;
+    assert_eq!(config, collector_credential.contents);
+    assert_eq!(name, collector_credential.name.unwrap());
+    Ok(())
+}
+
+#[test(harness = with_configured_client)]
+async fn delete_collector_credential(
+    app: Arc<DivviupApi>,
+    account: Account,
+    client: DivviupClient,
+) -> TestResult {
+    let collector_credential = fixtures::collector_credential(&app, &account).await;
+    client
+        .delete_collector_credential(collector_credential.id)
+        .await?;
+    assert!(collector_credential
+        .reload(app.db())
+        .await?
+        .unwrap()
+        .is_tombstoned());
+    Ok(())
+}
diff --git a/client/tests/hpke_configs.rs b/client/tests/hpke_configs.rs
deleted file mode 100644
index 324d600d..00000000
--- a/client/tests/hpke_configs.rs
+++ /dev/null
@@ -1,58 +0,0 @@
-mod harness;
-use divviup_api::api_mocks::aggregator_api::random_hpke_config;
-use divviup_client::DivviupClient;
-use harness::with_configured_client;
-use std::sync::Arc;
-use test_support::{assert_eq, test, *};
-
-#[test(harness = with_configured_client)]
-async fn hpke_configs_list(
-    app: Arc<DivviupApi>,
-    account: Account,
-    client: DivviupClient,
-) -> TestResult {
-    fixtures::hpke_config(&app, &account).await;
-    let hpke_configs = client.hpke_configs(account.id).await?;
-    assert_eq!(hpke_configs.len(), 1);
-    Ok(())
-}
-
-#[test(harness = with_configured_client)]
-async fn create_hpke_config(
-    _app: Arc<DivviupApi>,
-    account: Account,
-    client: DivviupClient,
-) -> TestResult {
-    let config = random_hpke_config();
-    let hpke_config = client.create_hpke_config(account.id, &config, None).await?;
-    assert_eq!(config, hpke_config.contents);
-    Ok(())
-}
-
-#[test(harness = with_configured_client)]
-async fn create_hpke_config_with_name(
-    _app: Arc<DivviupApi>,
-    account: Account,
-    client: DivviupClient,
-) -> TestResult {
-    let config = random_hpke_config();
-    let name = fixtures::random_name();
-    let hpke_config = client
-        .create_hpke_config(account.id, &config, Some(&name))
-        .await?;
-    assert_eq!(config, hpke_config.contents);
-    assert_eq!(name, hpke_config.name.unwrap());
-    Ok(())
-}
-
-#[test(harness = with_configured_client)]
-async fn delete_hpke_config(
-    app: Arc<DivviupApi>,
-    account: Account,
-    client: DivviupClient,
-) -> TestResult {
-    let hpke_config = fixtures::hpke_config(&app, &account).await;
-    client.delete_hpke_config(hpke_config.id).await?;
-    assert!(hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-    Ok(())
-}
diff --git a/client/tests/tasks.rs b/client/tests/tasks.rs
index 28001b57..812abc44 100644
--- a/client/tests/tasks.rs
+++ b/client/tests/tasks.rs
@@ -18,7 +18,7 @@ async fn task_list(app: Arc<DivviupApi>, account: Account, client: DivviupClient
 #[test(harness = with_configured_client)]
 async fn create_task(app: Arc<DivviupApi>, account: Account, client: DivviupClient) -> TestResult {
     let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-    let hpke_config = fixtures::hpke_config(&app, &account).await;
+    let collector_credential = fixtures::collector_credential(&app, &account).await;
     let response_task = client
         .create_task(
             account.id,
@@ -30,7 +30,7 @@ async fn create_task(app: Arc<DivviupApi>, account: Account, client: DivviupClie
                 min_batch_size: fastrand::i64(100..).try_into().unwrap(),
                 max_batch_size: None,
                 time_precision_seconds: fastrand::u64(60..2592000),
-                hpke_config_id: hpke_config.id,
+                collector_credential_id: collector_credential.id,
             },
         )
         .await?;
diff --git a/documentation/openapi.yml b/documentation/openapi.yml
index c526a5c8..4a6f1265 100644
--- a/documentation/openapi.yml
+++ b/documentation/openapi.yml
@@ -293,7 +293,7 @@ paths:
                 expiration:
                   type: string
                   format: date-time
-                hpke_config_id:
+                collector_credential_id:
                   type: string
                   format: uuid
                 time_precision_seconds:
@@ -307,7 +307,7 @@ paths:
                 - vdaf
                 - min_batch_size
                 - time_precision_seconds
-                - hpke_config_id
+                - collector_credential_id
       responses:
         "200":
           description: success
@@ -456,14 +456,14 @@ paths:
         "400":
           $ref: "#/components/responses/Invalid"
 
-  /accounts/{account_id}/hpke_configs:
+  /accounts/{account_id}/collector_credentials:
     parameters:
       - $ref: "#/components/parameters/AccountId"
     get:
       tags: ["hpke configs"]
       summary: list hpke configs for a given account
       description: list hpke configs for a given account
-      operationId: listHpkeConfigs
+      operationId: listCollectorCredentials
       responses:
         "200":
           description: success
@@ -472,7 +472,7 @@ paths:
               schema:
                 type: array
                 items:
-                  $ref: "#/components/schemas/HpkeConfig"
+                  $ref: "#/components/schemas/CollectorCredential"
         "404":
           $ref: "#/components/responses/NotFound"
 
@@ -480,7 +480,7 @@ paths:
       tags: ["hpke configs"]
       summary: create a new reusable hpke config for the account
       description: create a new reusable hpke config for the account
-      operationId: createHpkeConfig
+      operationId: createCollectorCredential
       requestBody:
         required: true
         content:
@@ -500,16 +500,16 @@ paths:
           content:
             application/vnd.divviup+json;version=0.1:
               schema:
-                $ref: "#/components/schemas/HpkeConfig"
+                $ref: "#/components/schemas/CollectorCredential"
         "404":
           $ref: "#/components/responses/NotFound"
         "400":
           $ref: "#/components/responses/Invalid"
 
-  /hpke_configs/{hpke_config_id}:
+  /collector_credentials/{collector_credential_id}:
     parameters:
       - in: path
-        name: hpke_config_id
+        name: collector_credential_id
         schema:
           type: string
           format: uuid
@@ -519,21 +519,21 @@ paths:
       tags: ["hpke configs"]
       summary: retrieve the hpke config by id
       description: retrieve the hpke config by id
-      operationId: showHpkeConfig
+      operationId: showCollectorCredential
       responses:
         "200":
           description: success
           content:
             application/vnd.divviup+json;version=0.1:
               schema:
-                $ref: "#/components/schemas/HpkeConfig"
+                $ref: "#/components/schemas/CollectorCredential"
         "404":
           $ref: "#/components/responses/NotFound"
     patch:
       tags: ["hpke configs"]
       summary: update the hpke config by id
       description: update the hpke config by id
-      operationId: updateHpkeConfig
+      operationId: updateCollectorCredential
       requestBody:
         required: true
         content:
@@ -549,14 +549,14 @@ paths:
           content:
             application/vnd.divviup+json;version=0.1:
               schema:
-                $ref: "#/components/schemas/HpkeConfig"
+                $ref: "#/components/schemas/CollectorCredential"
         "404":
           $ref: "#/components/responses/NotFound"
     delete:
       tags: ["hpke configs"]
       summary: delete a hpke config by id
       description: delete a hpke config by id
-      operationId: deleteHpkeConfig
+      operationId: deleteCollectorCredential
       responses:
         "204":
           description: Successful operation
@@ -723,7 +723,7 @@ components:
         helper_aggregator_id:
           type: string
           format: uuid
-        hpke_config_id:
+        collector_credential_id:
           type: string
           format: uuid
     Membership:
@@ -829,7 +829,7 @@ components:
             - code: required
               message:
               params: {}
-    HpkeConfig:
+    CollectorCredential:
       type: object
       properties:
         id:
diff --git a/migration/src/lib.rs b/migration/src/lib.rs
index 1ee7e47e..6162659e 100644
--- a/migration/src/lib.rs
+++ b/migration/src/lib.rs
@@ -20,6 +20,7 @@ mod m20230808_204859_create_hpke_config;
 mod m20230817_192017_add_protocol_to_aggregators;
 mod m20230907_175501_add_aggregator_onboarding_boolean_to_account;
 mod m20231012_205810_add_features_to_aggregators;
+mod m20231012_225001_rename_hpke_configs_to_collector_credentials;
 
 pub struct Migrator;
 
@@ -47,6 +48,7 @@ impl MigratorTrait for Migrator {
             Box::new(m20230817_192017_add_protocol_to_aggregators::Migration),
             Box::new(m20230907_175501_add_aggregator_onboarding_boolean_to_account::Migration),
             Box::new(m20231012_205810_add_features_to_aggregators::Migration),
+            Box::new(m20231012_225001_rename_hpke_configs_to_collector_credentials::Migration),
         ]
     }
 }
diff --git a/migration/src/m20231012_225001_rename_hpke_configs_to_collector_credentials.rs b/migration/src/m20231012_225001_rename_hpke_configs_to_collector_credentials.rs
new file mode 100644
index 00000000..6eb4c2ad
--- /dev/null
+++ b/migration/src/m20231012_225001_rename_hpke_configs_to_collector_credentials.rs
@@ -0,0 +1,67 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .rename_table(
+                TableRenameStatement::new()
+                    .table(HpkeConfig::Table, CollectorCredential::Table)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .alter_table(
+                TableAlterStatement::new()
+                    .table(Task::Table)
+                    .rename_column(Task::HpkeConfigId, Task::CollectorCredentialId)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .alter_table(
+                TableAlterStatement::new()
+                    .table(Task::Table)
+                    .rename_column(Task::CollectorCredentialId, Task::HpkeConfigId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .rename_table(
+                TableRenameStatement::new()
+                    .table(CollectorCredential::Table, HpkeConfig::Table)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum HpkeConfig {
+    Table,
+}
+
+#[derive(DeriveIden)]
+enum CollectorCredential {
+    Table,
+}
+
+#[derive(DeriveIden)]
+
+enum Task {
+    Table,
+    CollectorCredentialId,
+    HpkeConfigId,
+}
diff --git a/src/clients/aggregator_client/api_types.rs b/src/clients/aggregator_client/api_types.rs
index b9ab31d3..1c8a4622 100644
--- a/src/clients/aggregator_client/api_types.rs
+++ b/src/clients/aggregator_client/api_types.rs
@@ -260,7 +260,7 @@ impl TaskCreate {
             }),
             min_batch_size: new_task.min_batch_size,
             time_precision: new_task.time_precision_seconds,
-            collector_hpke_config: new_task.hpke_config.contents().clone(),
+            collector_hpke_config: new_task.collector_credential.contents().clone(),
             vdaf_verify_key: new_task.vdaf_verify_key.clone(),
             aggregator_auth_token: new_task
                 .aggregator_auth_token
diff --git a/src/entity.rs b/src/entity.rs
index 8e780793..cac1a5c8 100644
--- a/src/entity.rs
+++ b/src/entity.rs
@@ -2,7 +2,7 @@ pub mod account;
 pub mod aggregator;
 pub mod api_token;
 mod codec;
-pub mod hpke_config;
+pub mod collector_credential;
 mod json;
 pub mod membership;
 pub mod queue;
@@ -21,9 +21,9 @@ pub use aggregator::{
 pub use api_token::{
     Column as ApiTokenColumn, Entity as ApiTokens, Model as ApiToken, UpdateApiToken,
 };
-pub use hpke_config::{
-    Column as HpkeConfigColumn, Entity as HpkeConfigs, Model as HpkeConfig, NewHpkeConfig,
-    UpdateHpkeConfig,
+pub use collector_credential::{
+    Column as CollectorCredentialColumn, Entity as CollectorCredentials,
+    Model as CollectorCredential, NewCollectorCredential, UpdateCollectorCredential,
 };
 pub use membership::{
     Column as MembershipColumn, CreateMembership, Entity as Memberships, Model as Membership,
diff --git a/src/entity/account.rs b/src/entity/account.rs
index 672c5dfe..5ab95d93 100644
--- a/src/entity/account.rs
+++ b/src/entity/account.rs
@@ -1,5 +1,5 @@
 use crate::{
-    entity::{Aggregators, ApiTokens, HpkeConfigs, Memberships, Tasks},
+    entity::{Aggregators, ApiTokens, CollectorCredentials, Memberships, Tasks},
     PermissionsActor,
 };
 use sea_orm::{
@@ -51,8 +51,8 @@ pub enum Relation {
     Aggregators,
     #[sea_orm(has_many = "ApiTokens")]
     ApiTokens,
-    #[sea_orm(has_many = "HpkeConfigs")]
-    HpkeConfigs,
+    #[sea_orm(has_many = "CollectorCredentials")]
+    CollectorCredentials,
 }
 
 impl Related<Memberships> for Entity {
@@ -79,9 +79,9 @@ impl Related<ApiTokens> for Entity {
     }
 }
 
-impl Related<HpkeConfigs> for Entity {
+impl Related<CollectorCredentials> for Entity {
     fn to() -> RelationDef {
-        Relation::HpkeConfigs.def()
+        Relation::CollectorCredentials.def()
     }
 }
 
diff --git a/src/entity/hpke_config.rs b/src/entity/collector_credential.rs
similarity index 73%
rename from src/entity/hpke_config.rs
rename to src/entity/collector_credential.rs
index a9f02070..e8a803c6 100644
--- a/src/entity/hpke_config.rs
+++ b/src/entity/collector_credential.rs
@@ -13,7 +13,7 @@ use uuid::Uuid;
 use validator::{ValidationError, ValidationErrors};
 
 #[derive(Clone, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize, Debug)]
-#[sea_orm(table_name = "hpke_config")]
+#[sea_orm(table_name = "collector_credential")]
 pub struct Model {
     #[sea_orm(primary_key, auto_increment = false)]
     pub id: Uuid,
@@ -73,12 +73,12 @@ impl Related<Accounts> for Entity {
 impl ActiveModelBehavior for ActiveModel {}
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct NewHpkeConfig {
+pub struct NewCollectorCredential {
     contents: Option<String>,
     name: Option<String>,
 }
 
-impl NewHpkeConfig {
+impl NewCollectorCredential {
     pub fn build(self, account: &crate::entity::Account) -> Result<ActiveModel, crate::Error> {
         let string = self.contents.ok_or_else(|| {
             let mut validation_errors = ValidationErrors::new();
@@ -92,18 +92,19 @@ impl NewHpkeConfig {
             validation_errors
         })?;
 
-        let hpke_config = janus_messages::HpkeConfig::get_decoded(&bytes).map_err(|e| {
-            let mut validation_errors = ValidationErrors::new();
-            validation_errors.add(
-                "contents",
-                ValidationError {
-                    code: "hpke_config".into(),
-                    message: Some(e.to_string().into()),
-                    params: Default::default(),
-                },
-            );
-            validation_errors
-        })?;
+        let collector_credential =
+            janus_messages::HpkeConfig::get_decoded(&bytes).map_err(|e| {
+                let mut validation_errors = ValidationErrors::new();
+                validation_errors.add(
+                    "contents",
+                    ValidationError {
+                        code: "collector_credential".into(),
+                        message: Some(e.to_string().into()),
+                        params: Default::default(),
+                    },
+                );
+                validation_errors
+            })?;
 
         Ok(Model {
             id: Uuid::new_v4(),
@@ -111,7 +112,7 @@ impl NewHpkeConfig {
             created_at: OffsetDateTime::now_utc(),
             updated_at: OffsetDateTime::now_utc(),
             deleted_at: None,
-            contents: hpke_config.into(),
+            contents: collector_credential.into(),
             name: self.name,
         }
         .into_active_model())
@@ -119,15 +120,15 @@ impl NewHpkeConfig {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct UpdateHpkeConfig {
+pub struct UpdateCollectorCredential {
     name: Option<String>,
 }
 
-impl UpdateHpkeConfig {
-    pub fn build(self, hpke_config: Model) -> Result<ActiveModel, crate::Error> {
-        let mut hpke_config = hpke_config.into_active_model();
-        hpke_config.updated_at = ActiveValue::Set(OffsetDateTime::now_utc());
-        hpke_config.name = ActiveValue::Set(self.name);
-        Ok(hpke_config)
+impl UpdateCollectorCredential {
+    pub fn build(self, collector_credential: Model) -> Result<ActiveModel, crate::Error> {
+        let mut collector_credential = collector_credential.into_active_model();
+        collector_credential.updated_at = ActiveValue::Set(OffsetDateTime::now_utc());
+        collector_credential.name = ActiveValue::Set(self.name);
+        Ok(collector_credential)
     }
 }
diff --git a/src/entity/task.rs b/src/entity/task.rs
index 6d1a9cd2..c2b7187a 100644
--- a/src/entity/task.rs
+++ b/src/entity/task.rs
@@ -2,7 +2,7 @@ use crate::{
     clients::aggregator_client::{api_types::TaskResponse, TaskMetrics},
     entity::{
         account, membership, AccountColumn, Accounts, Aggregator, AggregatorColumn, Aggregators,
-        HpkeConfigColumn, HpkeConfigs,
+        CollectorCredentialColumn, CollectorCredentials,
     },
 };
 use sea_orm::{
@@ -49,7 +49,7 @@ pub struct Model {
     pub expiration: Option<OffsetDateTime>,
     pub leader_aggregator_id: Uuid,
     pub helper_aggregator_id: Uuid,
-    pub hpke_config_id: Uuid,
+    pub collector_credential_id: Uuid,
 }
 
 impl Model {
@@ -127,11 +127,11 @@ pub enum Relation {
     LeaderAggregator,
 
     #[sea_orm(
-        belongs_to = "HpkeConfigs",
-        from = "Column::HpkeConfigId",
-        to = "HpkeConfigColumn::Id"
+        belongs_to = "CollectorCredentials",
+        from = "Column::CollectorCredentialId",
+        to = "CollectorCredentialColumn::Id"
     )]
-    HpkeConfig,
+    CollectorCredential,
 }
 
 impl Related<account::Entity> for Entity {
@@ -150,9 +150,9 @@ impl Related<membership::Entity> for Entity {
     }
 }
 
-impl Related<HpkeConfigs> for Entity {
+impl Related<CollectorCredentials> for Entity {
     fn to() -> RelationDef {
-        Relation::HpkeConfig.def()
+        Relation::CollectorCredential.def()
     }
 }
 
diff --git a/src/entity/task/new_task.rs b/src/entity/task/new_task.rs
index 56ef247e..57ac14fc 100644
--- a/src/entity/task/new_task.rs
+++ b/src/entity/task/new_task.rs
@@ -2,7 +2,8 @@ use super::*;
 use crate::{
     clients::aggregator_client::api_types::{AggregatorVdaf, QueryType},
     entity::{
-        aggregator::Role, Account, Aggregator, Aggregators, HpkeConfig, HpkeConfigColumn, Protocol,
+        aggregator::Role, Account, Aggregator, Aggregators, CollectorCredential,
+        CollectorCredentialColumn, Protocol,
     },
     handler::Error,
 };
@@ -43,7 +44,7 @@ pub struct NewTask {
     pub time_precision_seconds: Option<u64>,
 
     #[validate(required)]
-    pub hpke_config_id: Option<String>,
+    pub collector_credential_id: Option<String>,
 }
 
 async fn load_aggregator(
@@ -87,30 +88,30 @@ impl NewTask {
         }
     }
 
-    async fn load_hpke_config(
+    async fn load_collector_credential(
         &self,
         account: &Account,
         db: &impl ConnectionTrait,
-    ) -> Option<HpkeConfig> {
-        let id = Uuid::parse_str(self.hpke_config_id.as_deref()?).ok()?;
-        HpkeConfigs::find_by_id(id)
-            .filter(HpkeConfigColumn::AccountId.eq(account.id))
+    ) -> Option<CollectorCredential> {
+        let id = Uuid::parse_str(self.collector_credential_id.as_deref()?).ok()?;
+        CollectorCredentials::find_by_id(id)
+            .filter(CollectorCredentialColumn::AccountId.eq(account.id))
             .one(db)
             .await
             .ok()
             .flatten()
     }
 
-    async fn validate_hpke_config(
+    async fn validate_collector_credential(
         &self,
         account: &Account,
         db: &impl ConnectionTrait,
         errors: &mut ValidationErrors,
-    ) -> Option<HpkeConfig> {
-        match self.load_hpke_config(account, db).await {
-            Some(hpke_config) => Some(hpke_config),
+    ) -> Option<CollectorCredential> {
+        match self.load_collector_credential(account, db).await {
+            Some(collector_credential) => Some(collector_credential),
             None => {
-                errors.add("hpke_config_id", ValidationError::new("required"));
+                errors.add("collector_credential_id", ValidationError::new("required"));
                 None
             }
         }
@@ -254,7 +255,9 @@ impl NewTask {
     ) -> Result<ProvisionableTask, ValidationErrors> {
         let mut errors = Validate::validate(self).err().unwrap_or_default();
         self.validate_min_lte_max(&mut errors);
-        let hpke_config = self.validate_hpke_config(&account, db, &mut errors).await;
+        let collector_credential = self
+            .validate_collector_credential(&account, db, &mut errors)
+            .await;
         let aggregators = self.validate_aggregators(&account, db, &mut errors).await;
 
         let aggregator_vdaf = if let Some((leader, helper, protocol)) = aggregators.as_ref() {
@@ -289,7 +292,7 @@ impl NewTask {
                 max_batch_size: self.max_batch_size,
                 expiration: Some(OffsetDateTime::now_utc() + DEFAULT_EXPIRATION_DURATION),
                 time_precision_seconds: self.time_precision_seconds.unwrap(),
-                hpke_config: hpke_config.unwrap(),
+                collector_credential: collector_credential.unwrap(),
                 aggregator_auth_token: None,
                 protocol,
             })
diff --git a/src/entity/task/provisionable_task.rs b/src/entity/task/provisionable_task.rs
index 7ffe252d..1bcbe305 100644
--- a/src/entity/task/provisionable_task.rs
+++ b/src/entity/task/provisionable_task.rs
@@ -1,7 +1,7 @@
 use super::{ActiveModel, *};
 use crate::{
     clients::aggregator_client::api_types::{AggregatorVdaf, AuthenticationToken},
-    entity::{Account, Aggregator, HpkeConfig, Protocol, Task},
+    entity::{Account, Aggregator, CollectorCredential, Protocol, Task},
     handler::Error,
     Crypter,
 };
@@ -30,7 +30,7 @@ pub struct ProvisionableTask {
     pub max_batch_size: Option<u64>,
     pub expiration: Option<OffsetDateTime>,
     pub time_precision_seconds: u64,
-    pub hpke_config: HpkeConfig,
+    pub collector_credential: CollectorCredential,
     pub aggregator_auth_token: Option<String>,
     pub protocol: Protocol,
 }
@@ -121,7 +121,7 @@ impl ProvisionableTask {
             expiration: self.expiration,
             leader_aggregator_id: self.leader_aggregator.id,
             helper_aggregator_id: self.helper_aggregator.id,
-            hpke_config_id: self.hpke_config.id,
+            collector_credential_id: self.collector_credential.id,
         }
         .into_active_model())
     }
diff --git a/src/routes.rs b/src/routes.rs
index 5275de54..864a04da 100644
--- a/src/routes.rs
+++ b/src/routes.rs
@@ -2,8 +2,8 @@ mod accounts;
 mod admin;
 mod aggregators;
 mod api_tokens;
+mod collector_credentials;
 mod health_check;
-mod hpke_configs;
 mod memberships;
 mod tasks;
 mod users;
@@ -80,9 +80,18 @@ fn api_routes() -> impl Handler {
             )
             .delete("/api_tokens/:api_token_id", api(api_tokens::delete))
             .patch("/api_tokens/:api_token_id", api(api_tokens::update))
-            .delete("/hpke_configs/:hpke_config_id", api(hpke_configs::delete))
-            .get("/hpke_configs/:hpke_config_id", api(hpke_configs::show))
-            .patch("/hpke_configs/:hpke_config_id", api(hpke_configs::update))
+            .delete(
+                "/collector_credentials/:collector_credential_id",
+                api(collector_credentials::delete),
+            )
+            .get(
+                "/collector_credentials/:collector_credential_id",
+                api(collector_credentials::show),
+            )
+            .patch(
+                "/collector_credentials/:collector_credential_id",
+                api(collector_credentials::update),
+            )
             .any(
                 &[Patch, Get, Post],
                 "/accounts/:account_id/*",
@@ -104,6 +113,6 @@ fn accounts_routes() -> impl Handler {
         .get("/aggregators", api(aggregators::index))
         .post("/api_tokens", api(api_tokens::create))
         .get("/api_tokens", api(api_tokens::index))
-        .get("/hpke_configs", api(hpke_configs::index))
-        .post("/hpke_configs", api(hpke_configs::create))
+        .get("/collector_credentials", api(collector_credentials::index))
+        .post("/collector_credentials", api(collector_credentials::create))
 }
diff --git a/src/routes/collector_credentials.rs b/src/routes/collector_credentials.rs
new file mode 100644
index 00000000..25ca599b
--- /dev/null
+++ b/src/routes/collector_credentials.rs
@@ -0,0 +1,85 @@
+use crate::{
+    entity::{
+        Account, CollectorCredential, CollectorCredentialColumn, CollectorCredentials,
+        NewCollectorCredential, UpdateCollectorCredential,
+    },
+    Db, Error, Permissions, PermissionsActor,
+};
+use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, ModelTrait, QueryFilter};
+use trillium::{Conn, Handler, Status};
+use trillium_api::{FromConn, Json};
+use trillium_caching_headers::CachingHeadersExt;
+use trillium_router::RouterConnExt;
+use uuid::Uuid;
+
+pub async fn index(_: &mut Conn, (account, db): (Account, Db)) -> Result<impl Handler, Error> {
+    account
+        .find_related(CollectorCredentials)
+        .filter(CollectorCredentialColumn::DeletedAt.is_null())
+        .all(&db)
+        .await
+        .map(Json)
+        .map_err(Error::from)
+}
+
+#[trillium::async_trait]
+impl FromConn for CollectorCredential {
+    async fn from_conn(conn: &mut Conn) -> Option<Self> {
+        let actor = PermissionsActor::from_conn(conn).await?;
+        let id = conn
+            .param("collector_credential_id")?
+            .parse::<Uuid>()
+            .ok()?;
+        let db: &Db = conn.state()?;
+        match CollectorCredentials::find_by_id(id).one(db).await {
+            Ok(Some(collector_credential)) => actor.if_allowed(conn.method(), collector_credential),
+            Ok(None) => None,
+            Err(error) => {
+                conn.set_state(Error::from(error));
+                None
+            }
+        }
+    }
+}
+
+impl Permissions for CollectorCredential {
+    fn allow_write(&self, actor: &PermissionsActor) -> bool {
+        actor.is_admin() || actor.account_ids().contains(&self.account_id)
+    }
+}
+
+pub async fn show(
+    conn: &mut Conn,
+    collector_credential: CollectorCredential,
+) -> Result<Json<CollectorCredential>, Error> {
+    conn.set_last_modified(collector_credential.updated_at.into());
+    Ok(Json(collector_credential))
+}
+
+pub async fn create(
+    _: &mut Conn,
+    (account, db, Json(collector_credential)): (Account, Db, Json<NewCollectorCredential>),
+) -> Result<impl Handler, Error> {
+    let collector_credential = collector_credential.build(&account)?.insert(&db).await?;
+    Ok((Status::Created, Json(collector_credential)))
+}
+
+pub async fn delete(
+    _: &mut Conn,
+    (collector_credential, db): (CollectorCredential, Db),
+) -> Result<Status, Error> {
+    collector_credential.tombstone().update(&db).await?;
+    Ok(Status::NoContent)
+}
+
+pub async fn update(
+    _: &mut Conn,
+    (collector_credential, db, Json(update)): (
+        CollectorCredential,
+        Db,
+        Json<UpdateCollectorCredential>,
+    ),
+) -> Result<impl Handler, Error> {
+    let token = update.build(collector_credential)?.update(&db).await?;
+    Ok((Json(token), Status::Ok))
+}
diff --git a/src/routes/hpke_configs.rs b/src/routes/hpke_configs.rs
deleted file mode 100644
index 264e524b..00000000
--- a/src/routes/hpke_configs.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-use crate::{
-    entity::{Account, HpkeConfig, HpkeConfigColumn, HpkeConfigs, NewHpkeConfig, UpdateHpkeConfig},
-    Db, Error, Permissions, PermissionsActor,
-};
-use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, ModelTrait, QueryFilter};
-use trillium::{Conn, Handler, Status};
-use trillium_api::{FromConn, Json};
-use trillium_caching_headers::CachingHeadersExt;
-use trillium_router::RouterConnExt;
-use uuid::Uuid;
-
-pub async fn index(_: &mut Conn, (account, db): (Account, Db)) -> Result<impl Handler, Error> {
-    account
-        .find_related(HpkeConfigs)
-        .filter(HpkeConfigColumn::DeletedAt.is_null())
-        .all(&db)
-        .await
-        .map(Json)
-        .map_err(Error::from)
-}
-
-#[trillium::async_trait]
-impl FromConn for HpkeConfig {
-    async fn from_conn(conn: &mut Conn) -> Option<Self> {
-        let actor = PermissionsActor::from_conn(conn).await?;
-        let id = conn.param("hpke_config_id")?.parse::<Uuid>().ok()?;
-        let db: &Db = conn.state()?;
-        match HpkeConfigs::find_by_id(id).one(db).await {
-            Ok(Some(hpke_config)) => actor.if_allowed(conn.method(), hpke_config),
-            Ok(None) => None,
-            Err(error) => {
-                conn.set_state(Error::from(error));
-                None
-            }
-        }
-    }
-}
-
-impl Permissions for HpkeConfig {
-    fn allow_write(&self, actor: &PermissionsActor) -> bool {
-        actor.is_admin() || actor.account_ids().contains(&self.account_id)
-    }
-}
-
-pub async fn show(conn: &mut Conn, hpke_config: HpkeConfig) -> Result<Json<HpkeConfig>, Error> {
-    conn.set_last_modified(hpke_config.updated_at.into());
-    Ok(Json(hpke_config))
-}
-
-pub async fn create(
-    _: &mut Conn,
-    (account, db, Json(hpke_config)): (Account, Db, Json<NewHpkeConfig>),
-) -> Result<impl Handler, Error> {
-    let hpke_config = hpke_config.build(&account)?.insert(&db).await?;
-    Ok((Status::Created, Json(hpke_config)))
-}
-
-pub async fn delete(_: &mut Conn, (hpke_config, db): (HpkeConfig, Db)) -> Result<Status, Error> {
-    hpke_config.tombstone().update(&db).await?;
-    Ok(Status::NoContent)
-}
-
-pub async fn update(
-    _: &mut Conn,
-    (hpke_config, db, Json(update)): (HpkeConfig, Db, Json<UpdateHpkeConfig>),
-) -> Result<impl Handler, Error> {
-    let token = update.build(hpke_config)?.update(&db).await?;
-    Ok((Json(token), Status::Ok))
-}
diff --git a/test-support/src/fixtures.rs b/test-support/src/fixtures.rs
index 232d76d3..fa8c85a4 100644
--- a/test-support/src/fixtures.rs
+++ b/test-support/src/fixtures.rs
@@ -80,8 +80,8 @@ pub async fn member(app: &DivviupApi) -> (User, Account, Membership) {
     (user, account, membership)
 }
 
-pub async fn hpke_config(app: &DivviupApi, account: &Account) -> HpkeConfig {
-    HpkeConfig {
+pub async fn collector_credential(app: &DivviupApi, account: &Account) -> CollectorCredential {
+    CollectorCredential {
         contents: random_hpke_config().into(),
         created_at: OffsetDateTime::now_utc(),
         updated_at: OffsetDateTime::now_utc(),
@@ -99,7 +99,7 @@ pub async fn hpke_config(app: &DivviupApi, account: &Account) -> HpkeConfig {
 pub async fn task(app: &DivviupApi, account: &Account) -> Task {
     let leader_aggregator = aggregator(app, Some(account)).await;
     let helper_aggregator = aggregator(app, None).await;
-    let hpke_config = hpke_config(app, account).await;
+    let collector_credential = collector_credential(app, account).await;
 
     Task {
         id: random::<TaskId>().to_string(),
@@ -118,7 +118,7 @@ pub async fn task(app: &DivviupApi, account: &Account) -> Task {
         ),
         leader_aggregator_id: leader_aggregator.id,
         helper_aggregator_id: helper_aggregator.id,
-        hpke_config_id: hpke_config.id,
+        collector_credential_id: collector_credential.id,
     }
     .into_active_model()
     .insert(app.db())
diff --git a/test-support/src/lib.rs b/test-support/src/lib.rs
index 967e9de6..b10cb07b 100644
--- a/test-support/src/lib.rs
+++ b/test-support/src/lib.rs
@@ -71,7 +71,7 @@ pub async fn set_up_schema(db: &Db) {
     set_up_schema_for(&schema, db, queue::Entity).await;
     set_up_schema_for(&schema, db, Aggregators).await;
     set_up_schema_for(&schema, db, ApiTokens).await;
-    set_up_schema_for(&schema, db, HpkeConfigs).await;
+    set_up_schema_for(&schema, db, CollectorCredentials).await;
 }
 
 pub fn config(api_mocks: impl Handler) -> Config {
@@ -236,7 +236,7 @@ impl_reload!(Membership, Memberships);
 impl_reload!(Task, Tasks);
 impl_reload!(Aggregator, Aggregators);
 impl_reload!(ApiToken, ApiTokens);
-impl_reload!(HpkeConfig, HpkeConfigs);
+impl_reload!(CollectorCredential, CollectorCredentials);
 
 #[track_caller]
 pub fn assert_same_json_representation<Actual, Expected>(actual: &Actual, expected: &Expected)
diff --git a/tests/collector_credentials.rs b/tests/collector_credentials.rs
new file mode 100644
index 00000000..edcc70b7
--- /dev/null
+++ b/tests/collector_credentials.rs
@@ -0,0 +1,686 @@
+use divviup_api::{
+    api_mocks::aggregator_api::random_hpke_config, clients::aggregator_client::api_types,
+};
+use test_support::*;
+
+mod index {
+    use super::{assert_eq, test, *};
+
+    #[test(harness = set_up)]
+    async fn as_member(app: DivviupApi) -> TestResult {
+        let other_account = fixtures::account(&app).await;
+        let _ = fixtures::collector_credential(&app, &other_account).await;
+        let (user, account, ..) = fixtures::member(&app).await;
+        let collector_credential1 = fixtures::collector_credential(&app, &account).await;
+        let collector_credential2 = fixtures::collector_credential(&app, &account).await;
+        let deleted = fixtures::collector_credential(&app, &account).await;
+        let _deleted = deleted.tombstone().update(app.db()).await.unwrap();
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .run_async(&app)
+        .await;
+        assert_ok!(conn);
+
+        let collector_credentials: Vec<CollectorCredential> = conn.response_json().await;
+        assert_same_json_representation(
+            &collector_credentials,
+            &vec![collector_credential1, collector_credential2],
+        );
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn not_member(app: DivviupApi) -> TestResult {
+        let user = fixtures::user();
+
+        let account = fixtures::account(&app).await;
+        fixtures::collector_credential(&app, &account).await;
+        fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .run_async(&app)
+        .await;
+
+        assert_not_found!(conn);
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonexistant_account(app: DivviupApi) -> TestResult {
+        let user = fixtures::user();
+
+        let account = fixtures::account(&app).await;
+        fixtures::collector_credential(&app, &account).await;
+        fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get("/api/accounts/not-an-account/collector_credentials")
+            .with_api_headers()
+            .with_state(user)
+            .run_async(&app)
+            .await;
+
+        assert_not_found!(conn);
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_not_member(app: DivviupApi) -> TestResult {
+        let (admin, ..) = fixtures::admin(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential1 = fixtures::collector_credential(&app, &account).await;
+        let collector_credential2 = fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_state(admin)
+        .run_async(&app)
+        .await;
+
+        assert_ok!(conn);
+        let collector_credentials: Vec<CollectorCredential> = conn.response_json().await;
+        assert_same_json_representation(
+            &collector_credentials,
+            &vec![collector_credential1, collector_credential2],
+        );
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_token(app: DivviupApi) -> TestResult {
+        let token = fixtures::admin_token(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential1 = fixtures::collector_credential(&app, &account).await;
+        let collector_credential2 = fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+
+        assert_ok!(conn);
+        let collector_credentials: Vec<CollectorCredential> = conn.response_json().await;
+        assert_same_json_representation(
+            &collector_credentials,
+            &vec![collector_credential1, collector_credential2],
+        );
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn member_token(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &account).await;
+        let collector_credential1 = fixtures::collector_credential(&app, &account).await;
+        let collector_credential2 = fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+
+        assert_ok!(conn);
+        let collector_credentials: Vec<CollectorCredential> = conn.response_json().await;
+        assert_same_json_representation(
+            &collector_credentials,
+            &vec![collector_credential1, collector_credential2],
+        );
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonmember_token(app: DivviupApi) -> TestResult {
+        let other_account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &other_account).await;
+
+        let account = fixtures::account(&app).await;
+        fixtures::collector_credential(&app, &account).await;
+        fixtures::collector_credential(&app, &account).await;
+
+        let mut conn = get(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_not_found!(conn);
+        Ok(())
+    }
+}
+
+mod create {
+    use super::{assert_eq, test, *};
+
+    fn valid_collector_credential_json(hpke_config: api_types::HpkeConfig) -> Value {
+        json!({
+            "name": fixtures::random_name(),
+            "contents": encode_hpke_config(hpke_config)
+        })
+    }
+
+    #[test(harness = set_up)]
+    async fn success(app: DivviupApi) -> TestResult {
+        let (user, account, ..) = fixtures::member(&app).await;
+        let contents = random_hpke_config();
+
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .with_request_json(valid_collector_credential_json(contents.clone()))
+        .run_async(&app)
+        .await;
+        assert_response!(conn, 201);
+        let collector_credential: CollectorCredential = conn.response_json().await;
+        let collector_credential_from_db = collector_credential.reload(app.db()).await?.unwrap();
+        assert_eq!(collector_credential.contents, contents);
+        assert_same_json_representation(&collector_credential, &collector_credential_from_db);
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn not_member(app: DivviupApi) -> TestResult {
+        let user = fixtures::user();
+        let account = fixtures::account(&app).await; // no membership
+
+        let collector_credential_count_before =
+            CollectorCredentials::find().count(app.db()).await?;
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .with_request_json(valid_collector_credential_json(random_hpke_config()))
+        .run_async(&app)
+        .await;
+
+        assert_not_found!(conn);
+        let collector_credential_count_after = CollectorCredentials::find().count(app.db()).await?;
+        assert_eq!(
+            collector_credential_count_before,
+            collector_credential_count_after
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonexistant_account(app: DivviupApi) -> TestResult {
+        let user = fixtures::user();
+        let collector_credential_count_before =
+            CollectorCredentials::find().count(app.db()).await?;
+
+        let mut conn = post("/api/accounts/does-not-exist/collector_credentials")
+            .with_api_headers()
+            .with_state(user)
+            .with_request_json(valid_collector_credential_json(random_hpke_config()))
+            .run_async(&app)
+            .await;
+
+        assert_not_found!(conn);
+        let collector_credential_count_after = CollectorCredentials::find().count(app.db()).await?;
+        assert_eq!(
+            collector_credential_count_before,
+            collector_credential_count_after
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_not_member(app: DivviupApi) -> TestResult {
+        let (admin, ..) = fixtures::admin(&app).await;
+        let account = fixtures::account(&app).await;
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_request_json(valid_collector_credential_json(random_hpke_config()))
+        .with_state(admin)
+        .run_async(&app)
+        .await;
+
+        assert_response!(conn, 201);
+        let collector_credential: CollectorCredential = conn.response_json().await;
+        let collector_credential_from_db = collector_credential.reload(app.db()).await?.unwrap();
+        assert_same_json_representation(&collector_credential, &collector_credential_from_db);
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_token(app: DivviupApi) -> TestResult {
+        let token = fixtures::admin_token(&app).await;
+        let account = fixtures::account(&app).await;
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .with_request_json(valid_collector_credential_json(random_hpke_config()))
+        .run_async(&app)
+        .await;
+
+        assert_response!(conn, 201);
+        let collector_credential: CollectorCredential = conn.response_json().await;
+        let collector_credential_from_db = collector_credential.reload(app.db()).await?.unwrap();
+        assert_same_json_representation(&collector_credential, &collector_credential_from_db);
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn member_token(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &account).await;
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .with_request_json(valid_collector_credential_json(random_hpke_config()))
+        .run_async(&app)
+        .await;
+
+        assert_response!(conn, 201);
+        let collector_credential: CollectorCredential = conn.response_json().await;
+        let collector_credential_from_db = collector_credential.reload(app.db()).await?.unwrap();
+        assert_same_json_representation(&collector_credential, &collector_credential_from_db);
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonmember_token(app: DivviupApi) -> TestResult {
+        let other_account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &other_account).await;
+        let account = fixtures::account(&app).await;
+        let count_before = CollectorCredentials::find().count(app.db()).await?;
+        let mut conn = post(format!(
+            "/api/accounts/{}/collector_credentials",
+            account.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .with_request_json(valid_collector_credential_json(random_hpke_config()))
+        .run_async(&app)
+        .await;
+        assert_not_found!(conn);
+        let count_after = CollectorCredentials::find().count(app.db()).await?;
+        assert_eq!(count_before, count_after);
+        Ok(())
+    }
+}
+
+mod delete {
+    use uuid::Uuid;
+
+    use super::{assert_eq, test, *};
+
+    #[test(harness = set_up)]
+    async fn nonexistant_collector_credential(app: DivviupApi) -> TestResult {
+        let (user, ..) = fixtures::member(&app).await;
+        let mut conn = delete(format!("/api/collector_credentials/{}", Uuid::new_v4()))
+            .with_api_headers()
+            .with_state(user)
+            .run_async(&app)
+            .await;
+        assert_not_found!(conn);
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn as_member(app: DivviupApi) -> TestResult {
+        let (user, account, ..) = fixtures::member(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 204);
+        assert!(collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn non_member(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (user, ..) = fixtures::member(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let mut conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_state(user)
+        .run_async(&app)
+        .await;
+        assert_not_found!(conn);
+        assert!(!collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_not_member(app: DivviupApi) -> TestResult {
+        let (admin, ..) = fixtures::admin(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_state(admin)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 204);
+        assert!(collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_token(app: DivviupApi) -> TestResult {
+        let token = fixtures::admin_token(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 204);
+        assert!(collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn member_token(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 204);
+        assert!(collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonmember_token(app: DivviupApi) -> TestResult {
+        let other_account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &other_account).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let mut conn = delete(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_not_found!(conn);
+        assert!(!collector_credential
+            .reload(app.db())
+            .await?
+            .unwrap()
+            .is_tombstoned());
+        Ok(())
+    }
+}
+
+mod update {
+    use uuid::Uuid;
+
+    use super::{assert_eq, test, *};
+
+    #[test(harness = set_up)]
+    async fn nonexistant_collector_credential(app: DivviupApi) -> TestResult {
+        let (user, ..) = fixtures::member(&app).await;
+        let mut conn = patch(format!("/api/collector_credentials/{}", Uuid::new_v4()))
+            .with_request_json(json!({ "name": fixtures::random_name() }))
+            .with_api_headers()
+            .with_state(user)
+            .run_async(&app)
+            .await;
+        assert_not_found!(conn);
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn as_member(app: DivviupApi) -> TestResult {
+        let (user, account, ..) = fixtures::member(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let name = fixtures::random_name();
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": name }))
+        .with_state(user)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 200);
+        let response: CollectorCredential = conn.response_json().await;
+        assert_eq!(response.name.unwrap(), name);
+        assert_eq!(
+            collector_credential
+                .reload(app.db())
+                .await?
+                .unwrap()
+                .name
+                .unwrap(),
+            name
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn non_member(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (user, ..) = fixtures::member(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": fixtures::random_name() }))
+        .with_state(user)
+        .run_async(&app)
+        .await;
+        let name_before = collector_credential.name.clone();
+        assert_not_found!(conn);
+        assert_eq!(
+            collector_credential.reload(app.db()).await?.unwrap().name,
+            name_before
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_not_member(app: DivviupApi) -> TestResult {
+        let (admin, ..) = fixtures::admin(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let name = fixtures::random_name();
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": name }))
+        .with_state(admin)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 200);
+        let response: CollectorCredential = conn.response_json().await;
+        assert_eq!(response.name.unwrap(), name);
+        assert_eq!(
+            collector_credential
+                .reload(app.db())
+                .await?
+                .unwrap()
+                .name
+                .unwrap(),
+            name
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn admin_token(app: DivviupApi) -> TestResult {
+        let token = fixtures::admin_token(&app).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let name = fixtures::random_name();
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": name }))
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 200);
+        let response: CollectorCredential = conn.response_json().await;
+        assert_eq!(response.name.unwrap(), name);
+        assert_eq!(
+            collector_credential
+                .reload(app.db())
+                .await?
+                .unwrap()
+                .name
+                .unwrap(),
+            name
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn member_token(app: DivviupApi) -> TestResult {
+        let account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let name = fixtures::random_name();
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": name }))
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_status!(conn, 200);
+        let response: CollectorCredential = conn.response_json().await;
+        assert_eq!(response.name.unwrap(), name);
+        assert_eq!(
+            collector_credential
+                .reload(app.db())
+                .await?
+                .unwrap()
+                .name
+                .unwrap(),
+            name
+        );
+
+        Ok(())
+    }
+
+    #[test(harness = set_up)]
+    async fn nonmember_token(app: DivviupApi) -> TestResult {
+        let other_account = fixtures::account(&app).await;
+        let (_, token) = fixtures::api_token(&app, &other_account).await;
+        let account = fixtures::account(&app).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
+        let name_before = collector_credential.name.clone();
+        let name = fixtures::random_name();
+        let mut conn = patch(format!(
+            "/api/collector_credentials/{}",
+            collector_credential.id
+        ))
+        .with_api_headers()
+        .with_request_json(json!({ "name": name }))
+        .with_auth_header(token)
+        .run_async(&app)
+        .await;
+        assert_not_found!(conn);
+        assert_eq!(
+            collector_credential.reload(app.db()).await?.unwrap().name,
+            name_before
+        );
+        Ok(())
+    }
+}
diff --git a/tests/hpke_configs.rs b/tests/hpke_configs.rs
deleted file mode 100644
index e39db955..00000000
--- a/tests/hpke_configs.rs
+++ /dev/null
@@ -1,550 +0,0 @@
-use divviup_api::{
-    api_mocks::aggregator_api::random_hpke_config, clients::aggregator_client::api_types,
-};
-use test_support::*;
-
-mod index {
-    use super::{assert_eq, test, *};
-
-    #[test(harness = set_up)]
-    async fn as_member(app: DivviupApi) -> TestResult {
-        let other_account = fixtures::account(&app).await;
-        let _ = fixtures::hpke_config(&app, &other_account).await;
-        let (user, account, ..) = fixtures::member(&app).await;
-        let hpke_config1 = fixtures::hpke_config(&app, &account).await;
-        let hpke_config2 = fixtures::hpke_config(&app, &account).await;
-        let deleted = fixtures::hpke_config(&app, &account).await;
-        let _deleted = deleted.tombstone().update(app.db()).await.unwrap();
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_ok!(conn);
-
-        let hpke_configs: Vec<HpkeConfig> = conn.response_json().await;
-        assert_same_json_representation(&hpke_configs, &vec![hpke_config1, hpke_config2]);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn not_member(app: DivviupApi) -> TestResult {
-        let user = fixtures::user();
-
-        let account = fixtures::account(&app).await;
-        fixtures::hpke_config(&app, &account).await;
-        fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-
-        assert_not_found!(conn);
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonexistant_account(app: DivviupApi) -> TestResult {
-        let user = fixtures::user();
-
-        let account = fixtures::account(&app).await;
-        fixtures::hpke_config(&app, &account).await;
-        fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get("/api/accounts/not-an-account/hpke_configs")
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-
-        assert_not_found!(conn);
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_not_member(app: DivviupApi) -> TestResult {
-        let (admin, ..) = fixtures::admin(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config1 = fixtures::hpke_config(&app, &account).await;
-        let hpke_config2 = fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_state(admin)
-            .run_async(&app)
-            .await;
-
-        assert_ok!(conn);
-        let hpke_configs: Vec<HpkeConfig> = conn.response_json().await;
-        assert_same_json_representation(&hpke_configs, &vec![hpke_config1, hpke_config2]);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_token(app: DivviupApi) -> TestResult {
-        let token = fixtures::admin_token(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config1 = fixtures::hpke_config(&app, &account).await;
-        let hpke_config2 = fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-
-        assert_ok!(conn);
-        let hpke_configs: Vec<HpkeConfig> = conn.response_json().await;
-        assert_same_json_representation(&hpke_configs, &vec![hpke_config1, hpke_config2]);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn member_token(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &account).await;
-        let hpke_config1 = fixtures::hpke_config(&app, &account).await;
-        let hpke_config2 = fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-
-        assert_ok!(conn);
-        let hpke_configs: Vec<HpkeConfig> = conn.response_json().await;
-        assert_same_json_representation(&hpke_configs, &vec![hpke_config1, hpke_config2]);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonmember_token(app: DivviupApi) -> TestResult {
-        let other_account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &other_account).await;
-
-        let account = fixtures::account(&app).await;
-        fixtures::hpke_config(&app, &account).await;
-        fixtures::hpke_config(&app, &account).await;
-
-        let mut conn = get(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        Ok(())
-    }
-}
-
-mod create {
-    use super::{assert_eq, test, *};
-
-    fn valid_hpke_config_json(hpke_config: api_types::HpkeConfig) -> Value {
-        json!({
-            "name": fixtures::random_name(),
-            "contents": encode_hpke_config(hpke_config)
-        })
-    }
-
-    #[test(harness = set_up)]
-    async fn success(app: DivviupApi) -> TestResult {
-        let (user, account, ..) = fixtures::member(&app).await;
-        let contents = random_hpke_config();
-
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_state(user)
-            .with_request_json(valid_hpke_config_json(contents.clone()))
-            .run_async(&app)
-            .await;
-        assert_response!(conn, 201);
-        let hpke_config: HpkeConfig = conn.response_json().await;
-        let hpke_config_from_db = hpke_config.reload(app.db()).await?.unwrap();
-        assert_eq!(hpke_config.contents, contents);
-        assert_same_json_representation(&hpke_config, &hpke_config_from_db);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn not_member(app: DivviupApi) -> TestResult {
-        let user = fixtures::user();
-        let account = fixtures::account(&app).await; // no membership
-
-        let hpke_config_count_before = HpkeConfigs::find().count(app.db()).await?;
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_state(user)
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .run_async(&app)
-            .await;
-
-        assert_not_found!(conn);
-        let hpke_config_count_after = HpkeConfigs::find().count(app.db()).await?;
-        assert_eq!(hpke_config_count_before, hpke_config_count_after);
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonexistant_account(app: DivviupApi) -> TestResult {
-        let user = fixtures::user();
-        let hpke_config_count_before = HpkeConfigs::find().count(app.db()).await?;
-
-        let mut conn = post("/api/accounts/does-not-exist/hpke_configs")
-            .with_api_headers()
-            .with_state(user)
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .run_async(&app)
-            .await;
-
-        assert_not_found!(conn);
-        let hpke_config_count_after = HpkeConfigs::find().count(app.db()).await?;
-        assert_eq!(hpke_config_count_before, hpke_config_count_after);
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_not_member(app: DivviupApi) -> TestResult {
-        let (admin, ..) = fixtures::admin(&app).await;
-        let account = fixtures::account(&app).await;
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .with_state(admin)
-            .run_async(&app)
-            .await;
-
-        assert_response!(conn, 201);
-        let hpke_config: HpkeConfig = conn.response_json().await;
-        let hpke_config_from_db = hpke_config.reload(app.db()).await?.unwrap();
-        assert_same_json_representation(&hpke_config, &hpke_config_from_db);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_token(app: DivviupApi) -> TestResult {
-        let token = fixtures::admin_token(&app).await;
-        let account = fixtures::account(&app).await;
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .run_async(&app)
-            .await;
-
-        assert_response!(conn, 201);
-        let hpke_config: HpkeConfig = conn.response_json().await;
-        let hpke_config_from_db = hpke_config.reload(app.db()).await?.unwrap();
-        assert_same_json_representation(&hpke_config, &hpke_config_from_db);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn member_token(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &account).await;
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .run_async(&app)
-            .await;
-
-        assert_response!(conn, 201);
-        let hpke_config: HpkeConfig = conn.response_json().await;
-        let hpke_config_from_db = hpke_config.reload(app.db()).await?.unwrap();
-        assert_same_json_representation(&hpke_config, &hpke_config_from_db);
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonmember_token(app: DivviupApi) -> TestResult {
-        let other_account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &other_account).await;
-        let account = fixtures::account(&app).await;
-        let count_before = HpkeConfigs::find().count(app.db()).await?;
-        let mut conn = post(format!("/api/accounts/{}/hpke_configs", account.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .with_request_json(valid_hpke_config_json(random_hpke_config()))
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        let count_after = HpkeConfigs::find().count(app.db()).await?;
-        assert_eq!(count_before, count_after);
-        Ok(())
-    }
-}
-
-mod delete {
-    use uuid::Uuid;
-
-    use super::{assert_eq, test, *};
-
-    #[test(harness = set_up)]
-    async fn nonexistant_hpke_config(app: DivviupApi) -> TestResult {
-        let (user, ..) = fixtures::member(&app).await;
-        let mut conn = delete(format!("/api/hpke_configs/{}", Uuid::new_v4()))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn as_member(app: DivviupApi) -> TestResult {
-        let (user, account, ..) = fixtures::member(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 204);
-        assert!(hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn non_member(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (user, ..) = fixtures::member(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let mut conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        assert!(!hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_not_member(app: DivviupApi) -> TestResult {
-        let (admin, ..) = fixtures::admin(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_state(admin)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 204);
-        assert!(hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_token(app: DivviupApi) -> TestResult {
-        let token = fixtures::admin_token(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 204);
-        assert!(hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn member_token(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 204);
-        assert!(hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonmember_token(app: DivviupApi) -> TestResult {
-        let other_account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &other_account).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let mut conn = delete(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        assert!(!hpke_config.reload(app.db()).await?.unwrap().is_tombstoned());
-        Ok(())
-    }
-}
-
-mod update {
-    use uuid::Uuid;
-
-    use super::{assert_eq, test, *};
-
-    #[test(harness = set_up)]
-    async fn nonexistant_hpke_config(app: DivviupApi) -> TestResult {
-        let (user, ..) = fixtures::member(&app).await;
-        let mut conn = patch(format!("/api/hpke_configs/{}", Uuid::new_v4()))
-            .with_request_json(json!({ "name": fixtures::random_name() }))
-            .with_api_headers()
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn as_member(app: DivviupApi) -> TestResult {
-        let (user, account, ..) = fixtures::member(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let name = fixtures::random_name();
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": name }))
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 200);
-        let response: HpkeConfig = conn.response_json().await;
-        assert_eq!(response.name.unwrap(), name);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name.unwrap(),
-            name
-        );
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn non_member(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (user, ..) = fixtures::member(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": fixtures::random_name() }))
-            .with_state(user)
-            .run_async(&app)
-            .await;
-        let name_before = hpke_config.name.clone();
-        assert_not_found!(conn);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name,
-            name_before
-        );
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_not_member(app: DivviupApi) -> TestResult {
-        let (admin, ..) = fixtures::admin(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let name = fixtures::random_name();
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": name }))
-            .with_state(admin)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 200);
-        let response: HpkeConfig = conn.response_json().await;
-        assert_eq!(response.name.unwrap(), name);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name.unwrap(),
-            name
-        );
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn admin_token(app: DivviupApi) -> TestResult {
-        let token = fixtures::admin_token(&app).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let name = fixtures::random_name();
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": name }))
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 200);
-        let response: HpkeConfig = conn.response_json().await;
-        assert_eq!(response.name.unwrap(), name);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name.unwrap(),
-            name
-        );
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn member_token(app: DivviupApi) -> TestResult {
-        let account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let name = fixtures::random_name();
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": name }))
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_status!(conn, 200);
-        let response: HpkeConfig = conn.response_json().await;
-        assert_eq!(response.name.unwrap(), name);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name.unwrap(),
-            name
-        );
-
-        Ok(())
-    }
-
-    #[test(harness = set_up)]
-    async fn nonmember_token(app: DivviupApi) -> TestResult {
-        let other_account = fixtures::account(&app).await;
-        let (_, token) = fixtures::api_token(&app, &other_account).await;
-        let account = fixtures::account(&app).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
-        let name_before = hpke_config.name.clone();
-        let name = fixtures::random_name();
-        let mut conn = patch(format!("/api/hpke_configs/{}", hpke_config.id))
-            .with_api_headers()
-            .with_request_json(json!({ "name": name }))
-            .with_auth_header(token)
-            .run_async(&app)
-            .await;
-        assert_not_found!(conn);
-        assert_eq!(
-            hpke_config.reload(app.db()).await?.unwrap().name,
-            name_before
-        );
-        Ok(())
-    }
-}
diff --git a/tests/tasks.rs b/tests/tasks.rs
index 8fd79a2e..f931547b 100644
--- a/tests/tasks.rs
+++ b/tests/tasks.rs
@@ -145,7 +145,7 @@ mod create {
     use divviup_api::entity::task::vdaf::Vdaf;
 
     fn valid_task_json(
-        hpke_config: &HpkeConfig,
+        collector_credential: &CollectorCredential,
         leader_aggregator: &Aggregator,
         helper_aggregator: &Aggregator,
     ) -> Value {
@@ -156,7 +156,7 @@ mod create {
             "vdaf": { "type": "count" },
             "min_batch_size": 500,
             "time_precision_seconds": 60,
-            "hpke_config_id": hpke_config.id
+            "collector_credential_id": collector_credential.id
         })
     }
 
@@ -164,12 +164,12 @@ mod create {
     async fn success(app: DivviupApi) -> TestResult {
         let (user, account, ..) = fixtures::member(&app).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_state(user)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
 
@@ -198,7 +198,7 @@ mod create {
                 "vdaf": { "type": "poplar1" },
                 "min_batch_size": 50,
                 "time_precision_seconds": 1,
-                "hpke_config": ""
+                "collector_credential": ""
             }))
             .run_async(&app)
             .await;
@@ -217,12 +217,12 @@ mod create {
         let user = fixtures::user();
         let account = fixtures::account(&app).await; // no membership
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_state(user)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
 
@@ -236,12 +236,12 @@ mod create {
         let user = fixtures::user();
         let account = fixtures::account(&app).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let mut conn = post("/api/accounts/does-not-exist/tasks")
             .with_api_headers()
             .with_state(user)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
 
@@ -255,12 +255,12 @@ mod create {
         let (admin, ..) = fixtures::admin(&app).await;
         let account = fixtures::account(&app).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_state(admin)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
 
@@ -275,12 +275,12 @@ mod create {
         let token = fixtures::admin_token(&app).await;
         let account = fixtures::account(&app).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_auth_header(token)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
 
@@ -295,12 +295,12 @@ mod create {
         let account = fixtures::account(&app).await;
         let (_, token) = fixtures::api_token(&app, &account).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
         let count_before = Tasks::find().count(app.db()).await?;
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_auth_header(token)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;
         let count_after = Tasks::find().count(app.db()).await?;
@@ -318,13 +318,13 @@ mod create {
 
         let account = fixtures::account(&app).await;
         let (leader, helper) = fixtures::aggregator_pair(&app, &account).await;
-        let hpke_config = fixtures::hpke_config(&app, &account).await;
+        let collector_credential = fixtures::collector_credential(&app, &account).await;
 
         let count_before = Tasks::find().count(app.db()).await?;
         let mut conn = post(format!("/api/accounts/{}/tasks", account.id))
             .with_api_headers()
             .with_auth_header(token)
-            .with_request_json(valid_task_json(&hpke_config, &leader, &helper))
+            .with_request_json(valid_task_json(&collector_credential, &leader, &helper))
             .run_async(&app)
             .await;