diff --git a/vng_api_common/contrib/__init__.py b/vng_api_common/contrib/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/vng_api_common/contrib/setup_configuration/__init__.py b/vng_api_common/contrib/setup_configuration/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/vng_api_common/contrib/setup_configuration/models.py b/vng_api_common/contrib/setup_configuration/models.py
new file mode 100644
index 00000000..ad96049e
--- /dev/null
+++ b/vng_api_common/contrib/setup_configuration/models.py
@@ -0,0 +1,18 @@
+from django_setup_configuration.models import ConfigurationModel
+from pydantic import Field
+
+from vng_api_common.models import JWTSecret
+
+
+class SingleJWTSecretConfigurationModel(ConfigurationModel):
+    class Meta:
+        django_model_refs = {
+            JWTSecret: [
+                "identifier",
+                "secret",
+            ]
+        }
+
+
+class JWTSecretsConfigurationModel(ConfigurationModel):
+    items: list[SingleJWTSecretConfigurationModel] = Field(default_factory=list)
diff --git a/vng_api_common/contrib/setup_configuration/steps.py b/vng_api_common/contrib/setup_configuration/steps.py
new file mode 100644
index 00000000..a6bf2a7b
--- /dev/null
+++ b/vng_api_common/contrib/setup_configuration/steps.py
@@ -0,0 +1,23 @@
+from django_setup_configuration.configuration import BaseConfigurationStep
+
+from vng_api_common.models import JWTSecret
+
+from .models import JWTSecretsConfigurationModel
+
+
+class JWTSecretsConfigurationStep(BaseConfigurationStep[JWTSecretsConfigurationModel]):
+    """
+    Configure credentials for Applications that need access
+    """
+
+    verbose_name = "Configuration to create credentials"
+    config_model = JWTSecretsConfigurationModel
+    namespace = "vng_api_common_credentials"
+    enable_setting = "vng_api_common_credentials_config_enable"
+
+    def execute(self, model: JWTSecretsConfigurationModel):
+        for config in model.items:
+            JWTSecret.objects.update_or_create(
+                identifier=config.identifier,
+                defaults={"secret": config.secret},
+            )