---
title: "Register a provider configuration"
method: POST
path: "/vault-provider-configs"
tags: ["Vaults"]
---

# Register a provider configuration

`POST /vault-provider-configs`

## Request

- Base URL: `https://api.onkernel.com`
- URL: `https://api.onkernel.com/vault-provider-configs`
- Auth: HTTP bearer

Register a configuration shared across the organization's projects. Names are unique within the organization; duplicate names return 409 without replacing credentials. A configuration serves many wallets. Secret credentials are never returned. Requires an organization-scoped credential or dashboard authentication; project-scoped credentials receive 403.

## Request body

- union: Provider-specific settings and credentials for a configuration shared across the organization's projects.
  - VaultLinkProviderConfigRequest: Register a customer-owned Link OAuth client for refreshing and revoking imported wallet grants. The customer is responsible for initiating OAuth flows to connect a user's wallet and handling the redirect to obtain a Link access token and refresh token.
    - `credentials` VaultLinkProviderClientCredentials, required
      - `client_id` string, required
      - `client_secret` string, required
      - `publishable_key` string: Stripe publishable key for the account that owns the Link OAuth client. Link requires it as the bearer credential when Kernel refreshes or revokes imported wallet grants; without it, those wallets stop working when the imported access token expires.
    - `name` string, required: Unique within the organization.
    - `provider` 'link', required
  - VaultAgentCardProviderConfigRequest: Register application credentials for AgentCard wallet enrollment and checkout approvals. Kernel obtains application access tokens using client_credentials.
    - `credentials` VaultAgentCardProviderClientCredentials, required
      - `client_id` string, required
      - `client_secret` string, required
    - `name` string, required: Unique within the organization.
    - `provider` 'agentcard', required

## Response `201`

Provider configuration registered

- union
  - VaultLinkProviderConfig: Response schema for a Link configuration, without secret credentials. Kernel generates the ID and timestamps. Configuration creation uses VaultLinkProviderConfigRequest.
    - `client_id` string, required: OAuth client identity; immutable. Secret credentials are never returned.
    - `created_at` string, date-time, required
    - `id` string, required
    - `name` string, required: Unique within the organization.
    - `provider` 'link', required
    - `publishable_key` string: Stripe publishable key sent to Link when refreshing and revoking wallet grants. Omitted when not configured.
    - `updated_at` string, date-time, required
  - VaultAgentCardProviderConfig: Response schema for an AgentCard configuration, without secret credentials. Kernel generates the ID and timestamps and introspects test_mode from the credentials. Configuration creation uses VaultAgentCardProviderConfigRequest.
    - `client_id` string, required
    - `created_at` string, date-time, required
    - `id` string, required
    - `name` string, required
    - `provider` 'agentcard', required
    - `test_mode` boolean, required: Introspected mode of the selected credential; true means sandbox objects.
    - `updated_at` string, date-time, required

## Other responses

- `400`: Bad Request – invalid input
- `401`: Unauthorized – missing or invalid authorization token
- `403`: Forbidden – insufficient permissions or plan
- `409`: Conflict – resource already exists
- `500`: Internal Server Error

## Changes

- **2026-10-16** `03b369edee49`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kernel/apis/kernel-api/changes/vault-provider-configs/post.md)

---

[API](https://skmtc.dev/kernel/apis/kernel-api.md) - [All operations](https://skmtc.dev/kernel/apis/kernel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kernel/apis/kernel-api/revisions/0f6cf4f58fe6?raw)