---
title: "Create Target Credential"
method: POST
path: "/v1/targets/{target_id}/credentials"
tags: ["Credentials"]
---

# Create Target Credential

`POST /v1/targets/{target_id}/credentials`

## Request

- Base URL: `https://api.mindfort.app`
- URL: `https://api.mindfort.app/v1/targets/{target_id}/credentials`
- Auth: HTTP bearer

Store a credential on a target. Email MFA requires pending_email_id; username and password are optional and should be supplied only when the target requests primary credentials. Before adding an api_key credential, the API target must already have non-empty api_auth_instructions; update the target with the validation route, HTTP method, request shape, and successful response first.

## Path parameters

- `target_id` string, uuid, required

## Request body

- TargetCredentialCreateRequest
  - `credential_name` string, required
  - `credential_type` 'application_login' | 'magic_link' | 'email_mfa' | 'authenticator_2fa' | 'sms_mfa' | 'sms_login' | 'api_key', required
  - `username` string, nullable: Username for login credential types. Optional for email_mfa.
  - `password` string, nullable: Password for login credential types. Optional for email_mfa.
  - `role` 'user' | 'admin' | 'viewer' | 'editor' | 'custom'
  - `description` string, nullable
  - `login_instructions` string, nullable
  - `additional_auth_instructions` string, nullable: Instructions specific to this credential, used during authentication. Plain text only; HTML tags and unsupported control characters are rejected.
  - `pending_email_id` string, uuid, nullable
  - `authenticator_2fa_secret` string, nullable
  - `api_key_credential` APIKeyCredentialInput
    - `secret` string, required
    - `placement` APIKeyPlacementInput
      - `kind` 'bearer' | 'header' | 'query' | 'json_body'
      - `header_name` string, nullable: Valid only for header placement; defaults to X-API-Key.
      - `query_param` string, nullable: Valid only for query placement; defaults to api_key.
      - `json_field_path` string, nullable: Required for json_body placement; not accepted for other placement kinds.
      - `bearer_prefix` string, nullable: Valid only for bearer placement; defaults to Bearer followed by a space.
      - `extra_headers` object, nullable
    - `additional_fields` object, nullable
  - `sms_country_code` string, nullable

## Response `201`

Credential stored

- PublicTargetCredential
  - `id` string, uuid, required
  - `credential_name` string, nullable
  - `username` string, nullable
  - `role` string, required
  - `description` string, nullable
  - `login_instructions` string, nullable
  - `additional_auth_instructions` string, nullable: Instructions specific to this credential, used during authentication. Plain text only; HTML tags and unsupported control characters are rejected.
  - `credential_type` string, nullable
  - `generated_email` string, nullable
  - `authenticator_phone_number` string, nullable: System-provisioned phone number for SMS credentials; not a writable authenticator input.
  - `api_key_configured` boolean, required
  - `api_key_placement` PublicAPIKeyPlacement
    - `kind` 'bearer' | 'header' | 'query' | 'json_body' | 'aws_sigv4', required
    - `header_name` string, nullable
    - `query_param` string, nullable
    - `json_field_path` string, nullable
    - `bearer_prefix` string, nullable
    - `extra_headers` object, nullable
  - `api_additional_fields` object, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

---

[API](https://skmtc.dev/mindfort/apis/mindfort-api.md) - [All operations](https://skmtc.dev/mindfort/apis/mindfort-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mindfort/apis/mindfort-api/revisions/cb93bd79eebe?raw)