---
title: "Retrieve Credentials for a Kubernetes Cluster"
method: GET
path: "/v2/kubernetes/clusters/{cluster_id}/credentials"
tags: ["DigitalOcean-public.v2-new_Kubernetes"]
---

# Retrieve Credentials for a Kubernetes Cluster

`GET /v2/kubernetes/clusters/{cluster_id}/credentials`

This endpoint returns a JSON object . It can be used to programmatically
construct Kubernetes clients which cannot parse kubeconfig files.

The resulting JSON object contains token-based authentication for clusters
supporting it, and certificate-based authentication otherwise. For a list of
supported versions and more information, see "[How to Connect to a DigitalOcean
Kubernetes Cluster](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/)".

To retrieve credentials for accessing a Kubernetes cluster, send a GET
request to `/v2/kubernetes/clusters/$K8S_CLUSTER_ID/credentials`.

Clusters supporting token-based authentication may define an expiration by
passing a duration in seconds as a query parameter to
`/v2/kubernetes/clusters/$K8S_CLUSTER_ID/credentials?expiry_seconds=$DURATION_IN_SECONDS`.
If not set or 0, then the token will have a 7 day expiry. The query parameter
has no impact in certificate-based authentication.

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `expiry_seconds` integer

## Response `200`

A JSON object containing credentials for a cluster.

- Credentials
  - `server` string, uri — The URL used to access the cluster API server.
  - `certificate_authority_data` string, byte — A base64 encoding of bytes representing the certificate authority data for accessing the cluster.
  - `client_certificate_data` string, byte, nullable — A base64 encoding of bytes representing the x509 client certificate data for access the cluster. This is only returned for clusters without support for token-based authentication. Newly created Kubernetes clusters do not return credentials using certificate-based authentication. For additional information, [see here](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/#authenticate).
  - `client_key_data` string, byte, nullable — A base64 encoding of bytes representing the x509 client key data for access the cluster. This is only returned for clusters without support for token-based authentication. Newly created Kubernetes clusters do not return credentials using certificate-based authentication. For additional information, [see here](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/#authenticate).
  - `token` string — An access token used to authenticate with the cluster. This is only returned for clusters with support for token-based authentication.
  - `expires_at` string, date-time — A time value given in ISO8601 combined date and time format that represents when the access token expires.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

## Changes

- **2025-10-16** `cb3bf9b21459` — 2 info
  - api tag `DigitalOcean-public.v2-new_Kubernetes` added
  - api tag `Kubernetes` removed
- **2025-07-18** `f8e8c290636c` — 1 info
  - endpoint added
- **2025-07-17** `5fc9af728e82` — 1 breaking
  - api path removed without deprecation
- **2025-07-17** `f8e8c290636c` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/digitalocean/apis/digitalocean-api/changes/v2/kubernetes/clusters/:cluster_id/credentials/get.md)

---

[API](https://skmtc.dev/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.dev/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/revisions/cb3bf9b21459/schema)