---
title: "Create API credential"
method: POST
path: "/api/v2/credentials"
tags: ["Credentials"]
---

# Create API credential

`POST /api/v2/credentials`

Creates a new API credential for authenticating automated processes and integrations with the HiddenLayer API. The credential consists of an immutable client ID and client secret pair.

If no expiry is provided, the credential will automatically expire one year from creation. In accordance with standard industry best practices, it is not recommended to set an expiration date-time more than 365 days in the future.
If an expiration date is set more than 365 days in the future, the request will be rejected with a 422 Unprocessable Entity response.

By default, if no permissions are specified, the credential will be granted all available permissions. To restrict the credential to specific permissions, provide a list of permission strings. The available permissions can be found by calling the <a href="#operation/list_permissions_api_v2_permissions_get">/api/v2/permissions</a> endpoint.

## Response `201`

Created Credentials

## Other responses

- `400` — The request failed due to a client error, with one or more of the following possible causes: 1. The request required a tenant_id field, which was missing. 2. The request was malformed syntactically or semantically.
- `422` — Validation Error
- `500` — An unexpected error occurred preventing the operation from being performed.

---

[API](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api.md) · [All operations](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hiddenlayerai/hiddenlayer-audit-api/revisions/c3af5f4a9a79/schema)