---
title: "Mint a narrower credential"
method: POST
path: "/credentials"
tags: ["Account"]
---

# Mint a narrower credential

`POST /credentials`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/credentials`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

Least privilege for agents (PLAN §8.2). Hand a subtask a credential
that can only do the subtask: an hour of life, one deployment, no
spending.

**A child can never exceed its parent, on any axis** — scopes,
lifetime, budget, or which resources it may touch (the monthly budget
and resource quotas are axes too). Asking for more is refused with the reason, never silently
trimmed.

Over REST the parent is the API key making the call, so its granted
scopes are the ceiling; there is no expiry or spend history to clamp
to, and the absolute caps apply instead. Minting from an MCP token
(via `impreza_mint_subcredential`) additionally clamps the child to
the parent's remaining lifetime and remaining daily budget (and,
once released, its remaining monthly budget).

The scope on this route is `read`, which looks wrong for a write and
is not: attenuation is the authority check, and requiring `manage`
would mean only the most powerful credential could ever delegate.
Sprawl is bounded by per-parent and per-account limits instead.

**The token is returned once.** There is no path that reads it back.

## Request body

- object
  - `scopes` string[], required
  - `ttl_seconds` integer
  - `spend_cap_cents` integer: Daily purchase ceiling. 0 means the credential cannot spend. Needs the manage scope.
  - `spend_monthly_cap_cents` integer: Monthly purchase ceiling (UTC calendar month). Optional — defaults to the daily grant, so "can spend" never silently means one day's budget thirty times. Must fit what the parent has left this month; 0 with a positive daily grant is refused as a contradiction.
  - `quotas` object: Resource ceilings, e.g. `{"servers":1,"deployments":3,"previews":2,"concurrent_builds":1}`. Each named dimension must fit inside the parent's number for it; a dimension left out is inherited from the parent. 0 blocks creating that resource at all.
  - `resources` object: Confine the credential, e.g. `{"deployment":["dpl_abc"]}`. Kinds: deployment, service, domain. A kind you do NOT name is a kind the credential cannot touch at all.
  - `label` string

## Response `200`

The new credential, with its token (shown once)

## Other responses

- `400`: The request asked for more than the caller holds

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)