---
title: "Create a credential"
method: POST
path: "/credentials/packages/{packageName}"
tags: ["Credentials"]
---

# Create a credential

`POST /credentials/packages/{packageName}`

Creates a credential under the given package with a `credentialName` and at least one field. Each field has a `fieldType` (email, username, password, api_token, phone_number, two_factor_secret, or backup_codes) and a value.

## Path parameters

- `packageName` string, required

## Request body

- object
  - `credentialName` string, required
  - `fields` object[], required
    - `fieldType` 'email' | 'username' | 'password' | 'api_token' | 'phone_number' | 'two_factor_secret' | 'backup_codes', required
    - `value` string, required

## Response `200`

Credential created

- object
  - `success` true, required
  - `message` string, required
  - `data` Credential, required
    - `ownerId` string, required
    - `createdBy` string, nullable, required
    - `userId` string, nullable, required — Deprecated: use createdBy (same value — the creating actor). Null for credentials created before rollout.
    - `packageName` string, required
    - `secretPath` string, required
    - `credentialName` string, required
    - `fields` object[], required
      - `fieldType` 'email' | 'username' | 'password' | 'api_token' | 'phone_number' | 'two_factor_secret' | 'backup_codes', required
      - `value` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `409` — Conflict
- `500` — Internal Server Error

## Changes

- **2026-07-07** `d5d1e5ee8188` — 1 breaking, 3 info
  - the response property `data/userId` became nullable for the status `200`
  - response property `data/userId` deprecated
  - added the required property `data/createdBy` to the response with the `200` status
  - added the required property `data/ownerId` to the response with the `200` status
- **2026-06-19** `ec76cd771e68` — 1 breaking, 1 warning
  - for the `path` request parameter `packageName`, the minLength was increased from `0` to `1`
  - for the `path` request parameter `packageName`, the maxLength was set to `200`
- **2026-05-30** `51d2493ba0f4` — 1 info
  - endpoint added
- **2026-05-30** `d06ce0f3c00d` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/droidrun/apis/droidrun-cloud/changes/credentials/packages/:packageName/post.md)

---

[API](https://skmtc.dev/droidrun/apis/droidrun-cloud.md) · [All operations](https://skmtc.dev/droidrun/apis/droidrun-cloud/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/droidrun/droidrun-cloud/revisions/cd80ab1b29b0/schema)