---
title: "Register a provider configuration"
method: POST
path: "/vault-provider-configs"
tags: ["Vaults"]
---

# Register a provider configuration

`POST /vault-provider-configs`

## Request

- Base URL: `https://api.onkernel.com`
- URL: `https://api.onkernel.com/vault-provider-configs`
- Auth: HTTP bearer

Register a configuration shared across the organization's projects. Names are unique within the organization; duplicate names return 409 without replacing credentials. A configuration serves many wallets. Secret credentials are never returned. Requires an organization-scoped credential or dashboard authentication; project-scoped credentials receive 403.

## Request body

- union: Provider-specific settings and credentials for a configuration shared across the organization's projects.
  - VaultLinkProviderConfigRequest: Register a customer-owned Link OAuth client for refreshing and revoking imported wallet grants. The customer is responsible for initiating OAuth flows to connect a user's wallet and handling the redirect to obtain a Link access token and refresh token.
    - `credentials` VaultLinkProviderClientCredentials, required
      - `client_id` string, required
      - `client_secret` string, required
      - `publishable_key` string: Stripe publishable key for the account that owns the Link OAuth client. Link requires it as the bearer credential when Kernel refreshes or revokes imported wallet grants; without it, those wallets stop working when the imported access token expires.
    - `name` string, required: Unique within the organization.
    - `provider` 'link', required
  - VaultAgentCardProviderConfigRequest: Register application credentials for AgentCard wallet enrollment and checkout approvals. Kernel obtains application access tokens using client_credentials.
    - `credentials` VaultAgentCardProviderClientCredentials, required
      - `client_id` string, required
      - `client_secret` string, required
    - `name` string, required: Unique within the organization.
    - `provider` 'agentcard', required

## Response `201`

Provider configuration registered

- union
  - VaultLinkProviderConfig: Response schema for a Link configuration, without secret credentials. Kernel generates the ID and timestamps. Configuration creation uses VaultLinkProviderConfigRequest.
    - `client_id` string, required: OAuth client identity; immutable. Secret credentials are never returned.
    - `created_at` string, date-time, required
    - `id` string, required
    - `name` string, required: Unique within the organization.
    - `provider` 'link', required
    - `publishable_key` string: Stripe publishable key sent to Link when refreshing and revoking wallet grants. Omitted when not configured.
    - `updated_at` string, date-time, required
  - VaultAgentCardProviderConfig: Response schema for an AgentCard configuration, without secret credentials. Kernel generates the ID and timestamps and introspects test_mode from the credentials. Configuration creation uses VaultAgentCardProviderConfigRequest.
    - `client_id` string, required
    - `created_at` string, date-time, required
    - `id` string, required
    - `name` string, required
    - `provider` 'agentcard', required
    - `test_mode` boolean, required: Introspected mode of the selected credential; true means sandbox objects.
    - `updated_at` string, date-time, required

## Other responses

- `400`: Bad Request – invalid input
- `401`: Unauthorized – missing or invalid authorization token
- `403`: Forbidden – insufficient permissions or plan
- `409`: Conflict – resource already exists
- `500`: Internal Server Error

## Changes

- **2026-09-30** `4f43b1518ec4`: 3 breaking, 2 info
  - added the new required request property `oneOf[#/components/schemas/VaultLinkProviderConfigRequest]/credentials/allOf[#/components/schemas/VaultLinkProviderClientCredentials]/client_id`
  - added the new required request property `oneOf[#/components/schemas/VaultLinkProviderConfigRequest]/credentials/allOf[#/components/schemas/VaultLinkProviderClientCredentials]/client_secret`
  - the `oneOf[#/components/schemas/VaultLinkProviderConfigRequest]/credentials/allOf[#/components/schemas/VaultLinkProviderClientCredentials]/` request property type changed from no type to `object`
  - added the new optional request property `oneOf[#/components/schemas/VaultLinkProviderConfigRequest]/credentials/allOf[#/components/schemas/VaultLinkProviderClientCredentials]/publishable_key`
  - …1 more
- **2026-09-11** `8b63434ce269`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/onkernel/apis/kernel-api/changes/vault-provider-configs/post.md)

---

[API](https://skmtc.dev/onkernel/apis/kernel-api.md) - [All operations](https://skmtc.dev/onkernel/apis/kernel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/onkernel/apis/kernel-api/revisions/0f6cf4f58fe6?raw)