Projects

Create a named project credential (owner-only)

Creates a named, individually revocable project credential. Owner membership on the project's owning org plus a fresh step-up is required; a grant key can NEVER create one (that would let a scoped agent credential escalate itself into a permanent root). Several credentials may be live per kind at once — that overlap is how you rotate without downtime. The secret is returned exactly once.

post/projects/v1/{project_id}/credentials

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/projects/v1/{project_id}/credentials
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer

Path parameters

project_idstring required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

kind'anon' | 'service' required
namestring required
expires_atstring date-time nullable

Example request

{
  "name": "prod-deployer"
}

Response

Created. Carries the secret ONCE.

credential_idstring
project_idstring
kind'anon' | 'service'
namestring
created_atstring date-time
last_used_atstring date-time nullable
expires_atstring date-time nullable
revoked_atstring date-time nullable
revoked_reasonstring nullable
replacement_ofstring nullable
secretstring

The credential secret, returned EXACTLY ONCE and never recoverable afterwards. Store it immediately. Responses carrying it are sent with Cache-Control: no-store and must not be persisted to any client-side result cache.

next_actionsobject[]

Changes

No recorded changes to this operation across all 1 revision of this API.