---
title: "Create an explicit user-bound account credential"
method: POST
path: "/account-credentials"
tags: ["Account credentials"]
---

# Create an explicit user-bound account credential

`POST /account-credentials`

## Request

- Base URL: `https://app.communicate.so/api/v1`
- URL: `https://app.communicate.so/api/v1/account-credentials`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Secure-better-auth.session_token`
  - API key in cookie `better-auth.session_token`

Use an explicit credentials:write account bearer grant or a live email-verified application session, plus the current account password as fresh identity proof. Cookie writes require a trusted Origin. Machine callers cannot issue scopes beyond their own grant or outlive it. Creation and rotation return the secret once; metadata never includes it. Scope and expiry can only be narrowed. Issued credentials expire within 24 hours and no later than their issuer session; session revocation invalidates them.

## Headers

- `Origin` string, uri

## Request body

- AccountCredentialCreate
  - `name` string, required
  - `password` string, password, required
  - `scopes` string[], required
  - `audience` 'https://app.communicate.so/api/v1' | 'https://app.communicate.so/mcp'

## Response `201`

Create an explicit user-bound account credential

- AccountCredentialReceipt
  - `id` string, uuid, required
  - `name` string, required
  - `prefix` string, required
  - `scopes` string[], required
  - `expiresAt` string, date-time, required
  - `token` string, required: One-time credential secret; not present in subsequent metadata reads.

## Other responses

- `400`: Invalid request body or pagination.
- `401`: Session or credential missing, invalid, expired or revoked; fresh password proof failed when required.
- `403`: Email verification, trusted origin or required account scope is missing.
- `429`: Per-user list or password proof rate limit exceeded.
- `500`: Unexpected server failure.
- `503`: Identity service or freshly issued session unavailable.

---

[API](https://skmtc.dev/communicate/apis/communicate-public-rest-api-2.md) · [All operations](https://skmtc.dev/communicate/apis/communicate-public-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/communicate/apis/communicate-public-rest-api-2/revisions/db6be3d36733?raw)