---
title: "POST /gateway/v2/service-account/{vcluster}/{name}/scramcredential/{login}"
method: POST
path: "/gateway/v2/service-account/{vcluster}/{name}/scramcredential/{login}"
tags: ["cli_gateway-service-account_gateway_v2_10"]
---

# POST /gateway/v2/service-account/{vcluster}/{name}/scramcredential/{login}

`POST /gateway/v2/service-account/{vcluster}/{name}/scramcredential/{login}`

## Request

- Base URL: `https://developers.conduktor.io` (the document declares no server; this is the origin it was published from)
- URL: `https://developers.conduktor.io/gateway/v2/service-account/{vcluster}/{name}/scramcredential/{login}`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/conduktor/apis/conduktor-gateway-api/docs/gateway/v2/service-account/:vcluster/:name/scramcredential/:login/post.ts> (a function with typed inputs; its response is checked against the schema)

[![Generally Available](https://img.shields.io/badge/Lifecycle-Generally%20Available-blue)](#tag/Versioning)

Add a SCRAM credential to a service account.

The Gateway derives the verifier from the supplied password and stores only the verifier
(salt, stored key, server key) — never the clear password. The `login` is the SASL username
the client presents at handshake and must be globally unique across all virtual clusters.


> **Note:** This endpoint requires the service accounts feature flag to be enabled.
> Set `GATEWAY_FEATURE_FLAGS_SERVICE_ACCOUNTS=true` to enable this feature.

## Path parameters

- `vcluster` string, required
- `name` string, required
- `login` string, required

## Request body

- ScramCredentialRequest
  - `password` string, required: The clear password to derive the SCRAM verifier from. Never stored or logged.
  - `algorithm` 'SHA-512' | 'SHA-256': SCRAM hash algorithm. Defaults to SHA-512.
  - `iterationCount` integer: Hash iteration count, between 4096 (the RFC 5802 minimum, also the default) and 16384 (Kafka's maximum).

## Response `201`

- ScramCredentialMetadata
  - `login` string, required: The globally unique SCRAM login (the SASL username the client presents).
  - `algorithm` 'SHA-512' | 'SHA-256', required: SCRAM hash algorithm.
  - `iterationCount` integer, required: Hash iteration count.

## Other responses

- `400`: The request is not valid
- `401`: The given credentials are not valid
- `404`: The service account ... does not exist.
- `409`: The SCRAM login ... already exists, held by service account ... .
- `500`: An unexpected error occurred in the server

---

[API](https://skmtc.dev/conduktor/apis/conduktor-gateway-api.md) - [All operations](https://skmtc.dev/conduktor/apis/conduktor-gateway-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conduktor/apis/conduktor-gateway-api/revisions/73ad742aa630?raw)