---
title: "POST /developer-apps/{app_id}/credentials"
method: POST
path: "/developer-apps/{app_id}/credentials"
tags: ["Control plane"]
---

# POST /developer-apps/{app_id}/credentials

`POST /developer-apps/{app_id}/credentials`

## Request

- Base URL: `https://api.team0.ai/v1`
- URL: `https://api.team0.ai/v1/developer-apps/{app_id}/credentials`
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `https://clerk.team0.ai/oauth/authorize`, token URL `https://clerk.team0.ai/oauth/token`)
  - HTTP bearer

## Headers

- `Idempotency-Key` string, required

## Request body

- CredentialIssue
  - `name` string, required
  - `scopes` string[], required
  - `expires_at` string, date-time, required

## Response `201`

Credential issued. The first execution reveals the raw secret; an idempotent replay returns only redacted credential metadata.

- union: Reveal-once result on first execution or redacted credential metadata on idempotent replay.
  - CredentialReveal
    - `id` string, required
    - `object` 'api_credential', required
    - `name` string, required
    - `hint` string, required
    - `scopes` string[], required
    - `status` 'active' | 'expiring' | 'revoked' | 'expired', required
    - `expires_at` string, date-time, required
    - `version` integer, required
    - `secret` string, required
  - Credential
    - `id` string, required
    - `object` 'api_credential', required
    - `name` string, required
    - `hint` string, required
    - `scopes` string[], required
    - `status` 'active' | 'expiring' | 'revoked' | 'expired', required
    - `expires_at` string, date-time, required
    - `version` integer, required

## Other responses

- `default`: RFC 9457 problem response. Cross-tenant identity is non-enumerating.

---

[API](https://skmtc.dev/team0/apis/team0-external-api.md) · [All operations](https://skmtc.dev/team0/apis/team0-external-api/llms.txt) · [OpenAPI document](https://skmtc.dev/team0/apis/team0-external-api/revisions/9b838d20a98f?raw)