---
title: "Issue Widget Embed Credential"
method: POST
path: "/v1/widgets/embed-credentials"
tags: ["Widgets"]
---

# Issue Widget Embed Credential

`POST /v1/widgets/embed-credentials`

## Request

- Base URL: `https://api.sandbox.usenash.com`
- URL: `https://api.sandbox.usenash.com/v1/widgets/embed-credentials`
- Auth: none declared

Mint a server-to-server embed credential. The plaintext `secret` is returned **once**, in this response only; it is stored as a one-way hash and cannot be retrieved again.

## Request body

- IssueWidgetEmbedCredentialBody
  - `name` string, required: Operator-facing label, e.g. 'production'.
  - `expires_at` string, date-time, nullable: Optional expiry. Omit for a non-expiring credential.

## Response `200`

OK

- WidgetEmbedCredentialIssued: The one and only response shape that carries a plaintext secret. Callers must surface `secret` to the operator immediately; it cannot be recovered afterwards because only its hash is stored.
  - `credential` WidgetEmbedCredentialRead, required
    - `id` string, required
    - `organization_id` string, required
    - `name` string, required
    - `last_four` string, required
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `last_used_at` string, date-time, nullable
    - `created_by_user_id` string, nullable
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, nullable
    - `status` 'active' | 'expired' | 'revoked', required
  - `secret` string, required: Plaintext credential. Shown once, never retrievable again.

## Other responses

- `422`: Unprocessable Content

---

[API](https://skmtc.dev/nash/apis/nash-api.md) - [All operations](https://skmtc.dev/nash/apis/nash-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nash/apis/nash-api/revisions/e3713837c5c9?raw)