---
title: "Create application credential"
method: POST
path: "/zones/{zoneId}/application-credentials"
tags: ["Application Credentials"]
---

# Create application credential

`POST /zones/{zoneId}/application-credentials`

Creates a new application credential

## Path parameters

- `zoneId` string, required

## Request body

- union — Schema for creating a new application credential
  - IamApplicationCredentialCreateToken — Schema for creating a token application credential
    - `application_id` string, required — ID of the application this credential belongs to
    - `type` 'token', required
    - `provider_id` string, required — ID of the provider issuing tokens this credential verifies
    - `subject` string — Subject identifier for the token. When omitted, any token from the provider is accepted without checking application-specific claims.
  - IamApplicationCredentialCreatePassword — Schema for creating a password application credential
    - `application_id` string, required — ID of the application this credential belongs to
    - `type` 'password', required
    - `identifier` string — Username for password credential, also used as OAuth 2.0 client ID (auto-generated if not provided)
  - IamApplicationCredentialCreatePublicKey — Schema for creating a public key application credential
    - `application_id` string, required — ID of the application this credential belongs to
    - `type` 'public-key', required
    - `jwks_uri` string, uri, required — JWKS URI to retrieve public keys from
    - `identifier` string — Client ID for public key credential, also used as OAuth 2.0 client ID (auto-generated if not provided)
  - IamApplicationCredentialCreateUrl — Schema for creating a URL application credential
    - `application_id` string, required — ID of the application this credential belongs to
    - `type` 'url', required
    - `identifier` string, uri, required — URL of the credential (must be a valid URL)
  - IamApplicationCredentialCreatePublic — Schema for creating a public application credential
    - `application_id` string, required — ID of the application this credential belongs to
    - `type` 'public', required
    - `identifier` string — Identifier for public credential, also used as OAuth 2.0 client ID (auto-generated if not provided)

## Response `200`

Response for creating a new application credential

- union — Response for creating a new application credential
  - IamApplicationCredentialToken — Common fields shared by all application credential types
    - `id` string, required — Unique identifier of the credential
    - `organization_id` string, required — Organization that owns this credential
    - `zone_id` string, required — Zone this credential belongs to
    - `slug` string, required — URL-safe identifier, unique within the zone
    - `application_id` string, required — ID of the application this credential belongs to
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
    - `type` 'token', required
    - `provider_id` string, required — ID of the provider issuing tokens verified by this credential
    - `provider` IamProvider — A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
      - `id` string, required — Unique identifier of the provider
      - `organization_id` string, required — Organization that owns this provider
      - `zone_id` string, required — Zone this provider belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `identifier` string, required — User specified identifier, unique within the zone
      - `type` 'external' | 'keycard-vault' | 'keycard-sts'
      - `client_id` string, nullable — OAuth 2.0 client identifier
      - `client_secret_set` boolean — Indicates whether a client secret is configured
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamProviderOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `issuer` string, uri, required — OIDC issuer URL used for discovery and token validation.
          - `authorization_endpoint` string, uri, nullable
          - `token_endpoint` string, uri, nullable
          - `registration_endpoint` string, uri, nullable
          - `jwks_uri` string, uri, nullable
          - `code_challenge_methods_supported` string[], nullable
          - `scopes_supported` string[], nullable
          - `authorization_resource_enabled` boolean, nullable — Whether to include the resource parameter in authorization requests.
          - `authorization_resource_parameter` string, nullable — The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
          - `scope_parameter` string, nullable — The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
          - `scope_separator` string, nullable — The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
          - `token_response_access_token_pointer` string, nullable — Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
          - `authorization_parameters` object, nullable — Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
        - `openid` IamProviderOpenIDProtocol, nullable — OpenID Connect protocol configuration
          - `userinfo_endpoint` string, uri, nullable
          - `user_identifier_claim` string, nullable — Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
          - `external_id_claim` string, nullable — Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.
          - `scopes` string[], nullable — Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
          - `single_logout_enabled` boolean, nullable — When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.
      - `metadata` object, nullable — Provider metadata
        - `icon_url` string, uri — Icon URL
      - `owner_type` 'platform' | 'customer', required — Who owns this provider. Platform-owned providers cannot be modified via API.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `identifier` string, required — Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.
    - `subject` string, nullable — Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.
  - IamApplicationCredentialPassword — Common fields shared by all application credential types
    - `id` string, required — Unique identifier of the credential
    - `organization_id` string, required — Organization that owns this credential
    - `zone_id` string, required — Zone this credential belongs to
    - `slug` string, required — URL-safe identifier, unique within the zone
    - `application_id` string, required — ID of the application this credential belongs to
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
    - `type` 'password', required
    - `identifier` string, required — Username for password credential, also used as OAuth 2.0 client ID
    - `password` string — Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret
  - IamApplicationCredentialPublicKey — Common fields shared by all application credential types
    - `id` string, required — Unique identifier of the credential
    - `organization_id` string, required — Organization that owns this credential
    - `zone_id` string, required — Zone this credential belongs to
    - `slug` string, required — URL-safe identifier, unique within the zone
    - `application_id` string, required — ID of the application this credential belongs to
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
    - `type` 'public-key', required
    - `identifier` string, required — Client ID for public key credential, also used as OAuth 2.0 client ID
    - `jwks_uri` string, uri, required — JWKS URI to retrieve public keys from
  - IamApplicationCredentialUrl — Common fields shared by all application credential types
    - `id` string, required — Unique identifier of the credential
    - `organization_id` string, required — Organization that owns this credential
    - `zone_id` string, required — Zone this credential belongs to
    - `slug` string, required — URL-safe identifier, unique within the zone
    - `application_id` string, required — ID of the application this credential belongs to
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
    - `type` 'url', required
    - `identifier` string, uri, required — URL of the credential (must be a valid URL)
  - IamApplicationCredentialPublic — Common fields shared by all application credential types
    - `id` string, required — Unique identifier of the credential
    - `organization_id` string, required — Organization that owns this credential
    - `zone_id` string, required — Zone this credential belongs to
    - `slug` string, required — URL-safe identifier, unique within the zone
    - `application_id` string, required — ID of the application this credential belongs to
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
    - `type` 'public', required
    - `identifier` string, required — Identifier for public credential, also used as OAuth 2.0 client ID

## Other responses

- `400` — Error response
- `403` — Error response
- `404` — Error response
- `default` — Error response

## Changes

- **2026-08-26** `d65d51379d93` — 5 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`
  - added the optional property `anyOf[subschema #1: Application Credential Token]/allOf[subschema #2]/provider/allOf[subschema #1: Provider]/metadata/icon_url` to the response with the `200` status
  - …1 more
- **2026-07-01** `2f5033ed4491` — 6 info
  - added the optional property `anyOf[subschema #1: Application Credential Token]/allOf[subschema #1: Application Credential Base Fields]/application/allOf[subschema #1: Application]/metadata/icon_url` to the response with the `200` status
  - added the optional property `anyOf[subschema #1: Application Credential Token]/allOf[subschema #2]/provider/allOf[subschema #1: Provider]/protocols/openid/single_logout_enabled` to the response with the `200` status
  - added the optional property `anyOf[subschema #2: Application Credential Password]/allOf[subschema #1: Application Credential Base Fields]/application/allOf[subschema #1: Application]/metadata/icon_url` to the response with the `200` status
  - added the optional property `anyOf[subschema #3: Application Credential Public Key]/allOf[subschema #1: Application Credential Base Fields]/application/allOf[subschema #1: Application]/metadata/icon_url` to the response with the `200` status
  - …2 more
- …earlier changes not shown

[Full history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/application-credentials/post.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)