---
title: "Issue bucket credentials"
method: POST
path: "/api/v1/buckets/{bucketId}/credentials"
tags: ["Buckets"]
---

# Issue bucket credentials

`POST /api/v1/buckets/{bucketId}/credentials`

## Request

- Base URL: `https://app.khotan.com`
- URL: `https://app.khotan.com/api/v1/buckets/{bucketId}/credentials`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Issues a folder-scoped API key for the bucket and returns its secret once. The key acts only through the Files API and only within the bucket's folder subtree — send it as Authorization: Bearer against the Files API. Each call rotates the credential: any previously issued key for this bucket is revoked. The secret is shown once and is not retrievable afterward. The response filesApiBaseUrl already includes /api/v1 — append paths such as /files/... directly; do not append another /api/v1.

## Path parameters

- `bucketId` string, required

## Response `200`

The issued bucket credential (secret shown once).

- object
  - `apiKey` string, required: The API key secret. Send it as `Authorization: Bearer <apiKey>` to the Files API. Shown once — store it now; rotate to replace it.
  - `keyId` string, required
  - `prefix` string, nullable, required
  - `filesApiBaseUrl` string, required: Base URL for the Files API this key is authorized against. Already includes the `/api/v1` prefix — append resource paths such as `/files/...` directly. Do not append another `/api/v1`.

## Other responses

- `401`: Authentication is missing or invalid.
- `403`: The caller is not permitted to perform this action.
- `404`: The resource was not found.
- `409`: Response.
- `429`: Too many requests; retry after the indicated delay.

---

[API](https://skmtc.dev/khotan/apis/khotan-api.md) - [All operations](https://skmtc.dev/khotan/apis/khotan-api/llms.txt) - [OpenAPI document](https://skmtc.dev/khotan/apis/khotan-api/revisions/90b512a53e42?raw)