---
title: "Create one least-authority project credential"
method: POST
path: "/v1/projects/{project_id}/credentials"
tags: ["Automation"]
---

# Create one least-authority project credential

`POST /v1/projects/{project_id}/credentials`

## Request

- Base URL: `https://api.agentry.sh`
- URL: `https://api.agentry.sh/v1/projects/{project_id}/credentials`
- Auth: HTTP bearer

Owner-only and requires a stable Idempotency-Key. The raw value remains hash-only and is returned exactly once; an exact lost-response retry names the already-created credential and never mints another active secret. automation_runner requires an exact saved automation_id.

## Path parameters

- `project_id` string, required

## Headers

- `Idempotency-Key` string, required

## Request body

- object
  - `kind` 'ci_deploy' | 'automation_runner', required
  - `name` string, required
  - `automation_id` string
  - `expires_in_seconds` integer

## Response `200`

OK

- object
  - `id` string, required
  - `project_id` string, required
  - `kind` 'ci_deploy' | 'automation_runner', required
  - `name` string, required
  - `prefix` string, required
  - `scopes` string[], required
  - `automation_id` string, nullable
  - `created_by` string
  - `created_at` integer, required
  - `expires_at` integer, required
  - `last_used_at` integer, nullable
  - `revoked_at` integer, nullable
  - `revoke_reason` string, nullable
  - `active` boolean, required
  - `credential` string, required
  - `env_var` 'AGENTRY_CI_API_KEY' | 'AGENTRY_RUNNER_API_KEY', required
  - `runner_id` string, nullable
  - `idempotent_replay` boolean, required
  - `next_action` string, required

## Other responses

- `409`: Exact retry identifies the already-created hash-only credential instead of returning or minting a secret
- `default`: Error

---

[API](https://skmtc.dev/agentry/apis/agentry-api.md) · [All operations](https://skmtc.dev/agentry/apis/agentry-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentry/apis/agentry-api/revisions/abdecddf009f?raw)