---
title: "Create an agent credential"
method: POST
path: "/api/v2/agents/{agent_id}/inbound-credentials"
tags: ["Agents"]
---

# Create an agent credential

`POST /api/v2/agents/{agent_id}/inbound-credentials`

## Request

- Base URL: `https://console.jumpcloud.com`
- URL: `https://console.jumpcloud.com/api/v2/agents/{agent_id}/inbound-credentials`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/docs/api/v2/agents/:agent_id/inbound-credentials/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates the OAuth 2.0 credential for an agent in your organization.

## Path parameters

- `agent_id` string, required

## Headers

- `x-org-id` string

## Request body

- AgentInboundCredentialCreateRequest: Optional fields for inbound credential creation. Omit the request body or omit `lifetimeDays` to default to 365 days. Set `lifetimeDays` to `0` for a credential that never expires (`expiresAt` is null in the response). Responses do not include `lifetimeDays`; clients derive lifetime from `expiresAt` and `createdAt` when needed.
  - `lifetimeDays` 0 | 30 | 60 | 90 | 365: Credential lifetime in days. When the key is absent, defaults to 365. `0` means the credential never expires. Accepted values are 0, 30, 60, 90, and 365.

## Response `201`

Credential created successfully

- AgentInboundCredentialWithSecret: A newly created inbound OAuth credential. `clientSecret` is returned only in this response — store it now, since it cannot be retrieved again.
  - `clientId` string, required: Hydra OAuth client ID for this credential.
  - `clientSecret` string, required: One-time client secret.
  - `tokenEndpointAuthMethod` 'client_secret_basic' | 'client_secret_post', required: OAuth token endpoint client authentication method for this credential. Legacy rows with a NULL stored value are returned as `client_secret_basic`.
  - `expiresAt` string, date-time, nullable, required: ISO 8601 date-time (UTC) or JSON null.

## Other responses

- `400`: Bad request — validation failure. Common codes include `invalidLifetimeDays` and `invalid json`.
- `401`: Unauthenticated
- `404`: Not Found
- `409`: The request conflicts with the agent's current state. The agent already has an active credential, or the agent is suspended.
- `default`: Unexpected error

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/revisions/f396d9271b46?raw)