---
title: "Get cluster credentials"
method: GET
path: "/clusters/{cluster_id}/credentials"
tags: ["Cluster Operations"]
---

# Get cluster credentials

`GET /clusters/{cluster_id}/credentials`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/credentials`
- Auth: API key in header `API-Key`

Returns the cluster's automation client credentials (OAuth2 client_credentials) for programmatic access to your Keycloak. Keep these values secure.

Required scope: `clusters:credentials:read`

## Path parameters

- `cluster_id` string, uuid, required

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- ClusterCredentials: Programmatic automation credentials for a cluster's Keycloak (OAuth2 client_credentials grant). Use these from Terraform, CI, or MCP. Separate from Admin Console SSO (human login) and from your Skycloak API key (which manages clusters).
  - `client_id` string, required: Client ID of the cluster's automation service account.
  - `client_secret` string, password, required: Client secret for the automation service account. Use with the OAuth2 client_credentials grant.
  - `token_url` string, uri, required: Token endpoint URL (master realm). POST a client_credentials request here to obtain an access token.

## Other responses

- `401`: Access is unauthorized.
- `404`: The server cannot find the requested resource.
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)