---
title: "Create Extension Credential"
method: POST
path: "/browser-extension/credentials/"
tags: ["browser-extension"]
---

# Create Extension Credential

`POST /browser-extension/credentials/`

Exchange a full Supabase session for a narrow installation credential.

The extension calls this once right after connecting, stores the opaque
credential, and discards the session — so a compromised extension storage
leaks a revocable, extension-only bearer instead of the account. Only a
full session may mint; an installation credential cannot widen itself.
The raw value appears exactly once, in this response.

## Response `200`

Successful Response

- ExtensionCredentialResponse — A freshly issued installation credential. The raw credential appears only here — the server keeps a hash. The expiry is advisory scheduling data for the client's refresh; the server-side TTL remains the authority.
  - `credential` string, required
  - `expires_at` string, date-time, required
  - `scopes` string[], required

---

[API](https://skmtc.dev/helloaxel/apis/client-api-gateway.md) · [All operations](https://skmtc.dev/helloaxel/apis/client-api-gateway/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/helloaxel/client-api-gateway/revisions/d3c4c29fede7/schema)