---
title: "Define a binding: which secret may be typed, and into which hosts. Humans only, behind a step-up — an agent that could create one could nominate any path it liked as fillable."
method: POST
path: "/v1/browser/credentials"
tags: ["Browser Bridge"]
---

# Define a binding: which secret may be typed, and into which hosts. Humans only, behind a step-up — an agent that could create one could nominate any path it liked as fillable.

`POST /v1/browser/credentials`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/browser/credentials`
- Auth: HTTP bearer

## Request body

- object
  - `label` string, required
  - `vault_id` string, uuid, required: Must belong to the caller's org.
  - `secret_path` string, required: Path of the secret inside that vault. The value never lands in the binding.
  - `login_url` string, required: https only, and its host must be in allowed_hosts or sso_hosts — the bridge navigates here itself, one step before a password is typed.
  - `allowed_hosts` string[], required: Hostnames. A bare entry matches only itself; a leading dot ('.example.com') matches that host and any subdomain. URLs, ports and '*' are refused — '*' has no meaning to the matcher, so it would be stored and then match nothing.
  - `sso_hosts` string[]: Identity-provider hosts the login legitimately bounces through.

## Response `201`

Created. Every field is a pointer or a policy; none is secret.

## Other responses

- `400`: A host is not a bare hostname, allowed_hosts is empty, or login_url is http or outside the allowlist
- `403`: Not a human caller, step-up not satisfied, or the vault belongs to another org
- `404`: Vault not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)