---
title: "Create App Credential"
method: POST
path: "/apps/{app_id}/credentials"
tags: ["Apps"]
---

# Create App Credential

`POST /apps/{app_id}/credentials`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/{app_id}/credentials`
- Auth: HTTP bearer

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Create a service credential for one consented client organization.

**The secret is returned once and never again.** Only its SHA-256 is stored —
`developer_app_credentials` has no column that could hold a plaintext secret.
Rotate by creating a new credential and revoking the old one.

The target organization must already have a **consented** installation of
this app. A credential for a workspace that never consented would be a
standing key into a tenant that never agreed to it, and the M6-1d clamp would
refuse every request it minted anyway — failing here says why, instead of
leaving a credential that silently cannot work.

## Path parameters

- `app_id` string, required

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- CreateCredentialRequest: A builder minting a service credential for one consented tenant.
  - `client_org_id` string, required: The client organization this credential acts for. It must already have a consented installation of the app — a credential is bound to one tenant and cannot be pointed at another later.

## Response `201`

Successful Response

- ApiResponseCreatedCredentialResponse
  - `data` CreatedCredentialResponse, required: The create response, and the ONLY time the secret is ever returned. Only the SHA-256 is stored — `developer_app_credentials` has no column that could hold a plaintext secret — so this response cannot be reissued. That is the point: a secret the platform can re-read is a secret the platform can leak.
    - `app_id` string, required
    - `client_org_id` string, required
    - `client_id` string, required
    - `revoked` boolean
    - `created_at` string, date-time, nullable
    - `client_secret` string, required: Shown ONCE. Store it now — only its hash is kept, so it cannot be retrieved again. Rotate by creating a new credential and revoking this one.
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)