Credentials
Store, update, and test credentials via the API.
Endpoints for credentials under /api/v1/credentials. Product UI: Secrets and
Integrations and credentials.
Endpoints
| Method | Path | Description |
|---|---|---|
| GET | /api/v1/credentials | List credentials |
| POST | /api/v1/credentials | Create a credential |
| PATCH | /api/v1/credentials/{id} | Update a credential |
| DELETE | /api/v1/credentials/{id} | Delete a credential |
| POST | /api/v1/credentials/{id}/test | Test a credential |
List and create
GET /api/v1/credentials returns { credentials[] } with secret values masked (maskedValue). Optional
oauthScopes may appear when the stored JSON contains scopes.
POST /api/v1/credentials stores an encrypted secret (AES-256-GCM). v1 always creates scope: "workspace":
| Field | Type | Notes |
|---|---|---|
name | string | Required. Duplicate names in the same workspace scope update the existing row |
type | string | Credential type (for example githubApi, smtp, postgres, googleSheetsOAuth2Api) |
value | string | Inline secret (unless envVar resolves a deployment source) |
envVar | string | Allowed deployment sources only (DATABASE_URL, GITHUB_TOKEN, OPENAI_API_KEY, SMTP/Google/Jira/Microsoft/Supabase JSON, …), not arbitrary env names |
The value is validated for the given type and stored encrypted — it is never returned in plaintext.
Claude Code / Codex CLI session types cannot be created here (they are connected from the local AI
CLI worker login flow). Returns 201 with { credential }.
Update, delete, and test
PATCH /api/v1/credentials/{id} accepts { name, type, value }; omitting value leaves the stored
secret unchanged. DELETE returns { deleted: true }. Missing ids: 404.
POST /api/v1/credentials/{id}/test resolves the secret and runs a live connection check, returning
{ result }.