---
title: "Create a named project credential (owner-only)"
method: POST
path: "/projects/v1/{project_id}/credentials"
tags: ["Projects"]
---

# Create a named project credential (owner-only)

`POST /projects/v1/{project_id}/credentials`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/credentials`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Creates a named, individually revocable project credential. Owner membership on the project's owning org plus a fresh step-up is required; a grant key can NEVER create one (that would let a scoped agent credential escalate itself into a permanent root). Several credentials may be live per kind at once — that overlap is how you rotate without downtime. The secret is returned exactly once.

## Path parameters

- `project_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `kind` 'anon' | 'service', required
  - `name` string, required
  - `expires_at` string, date-time, nullable

## Response `201`

Created. Carries the secret ONCE.

- object
  - `credential_id` string
  - `project_id` string
  - `kind` 'anon' | 'service'
  - `name` string
  - `created_at` string, date-time
  - `last_used_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `revoked_at` string, date-time, nullable
  - `revoked_reason` string, nullable
  - `replacement_of` string, nullable
  - `secret` string: The credential secret, returned EXACTLY ONCE and never recoverable afterwards. Store it immediately. Responses carrying it are sent with `Cache-Control: no-store` and must not be persisted to any client-side result cache.
  - `next_actions` object[]

## Other responses

- `400`: Validation failed
- `403`: Not an owner of the project's org, or step-up required
- `409`: A live credential with that name already exists (CREDENTIAL_NAME_TAKEN)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)