---
title: "Issue Gateway Credentials"
method: POST
path: "/gateways/credentials"
tags: ["Gateway"]
---

# Issue Gateway Credentials

`POST /gateways/credentials`

Exchange the caller's credential for one that only the gateway accepts.

No permission check of its own: the result is strictly weaker than the credential
that bought it — same tenant scope, same run, fewer routes — so a caller can reach
nothing here it could not already reach with what it presented.

It does check the switch for the plane the caller named, because minting a credential
for a plane that will refuse every request is worse than refusing here: the caller
still has a pre-gateway path at this point and none once the run is under way.

## Request body

- GatewayCredentialsRequest — Optionally, which plane the caller is about to use the credential on. The exchange itself is plane-agnostic — one credential reaches both data planes — so this field exists for one reason: it is the only moment a caller that is about to use the MCP gateway talks to the API before it dials. Without it, an SDK asking for a credential cannot learn that the MCP plane is switched off until a tool call fails mid-run, which is far too late to fall back to dialling the server directly. Optional, so an older SDK that sends `{}` still gets a credential. That caller then meets the refusal on the data plane instead, which is a worse error but not a wrong one.
  - `plane` 'llm' | 'mcp'

## Response `200`

Successful Response

- GatewayCredentialsResponse — The scheme-tagged credential value, used verbatim as ``X-AG-Credentials``.
  - `credentials` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-20** `7a4b57044657` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/agenta-ai/apis/agenta-api/changes/gateways/credentials/post.md)

---

[API](https://skmtc.dev/agenta-ai/apis/agenta-api.md) · [All operations](https://skmtc.dev/agenta-ai/apis/agenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agenta-ai/apis/agenta-api/revisions/72f2feba8ccb?raw)