Sign in
Credentials

Issue a scoped credential on the branch

Changed on

Issues a new scoped service credential anchored to the specified branch. The response carries api_token and s3_secret_access_key exactly once — they are not stored server-side.

Note: This endpoint is currently in Beta.

post/projects/{project_id}/branches/{branch_id}/credentials

Request

  • Base URL: https://console.neon.tech/api/v2
  • URL: https://console.neon.tech/api/v2/projects/{project_id}/branches/{branch_id}/credentials
  • Auth: one of:
    • HTTP bearer
    • API key in cookie zenith
    • API key in cookie keycloak_token

Request body

namestring

Free-form customer label for the credential.

scopesCredentialScope[] required
principal_type'user' required

Principal type for the credential. Only user is customer-managed and accepted here. function and system credentials are platform-internal (e.g. function-serve auto-mint, presign signer) and are never issued through the customer-facing API.

Response

Credential issued — secrets shown once.

token_idstring required

Opaque credential id (e.g. nak_live_<32hex>).

token_id_shortstring required

First 12 hex chars of token_id; safe to log.

namestring

Customer-supplied label, echoed back from the request. Absent when not provided.

api_tokenstring required

Bearer token; returned exactly once.

s3_secret_access_keystring required

nsk_live_<64 hex>; the AWS_SECRET_ACCESS_KEY, returned exactly once.

scopesGrantedCredentialScope[] required
branch_idstring required
created_atstring date-time required
expires_atstring date-time

When the credential expires; absent means never expires.

Changes