---
title: "Create Credentials"
method: POST
path: "/credentials"
---

# Create Credentials

`POST /credentials`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/credentials`
- Auth: none declared

Mint a unified credential for the caller.

The grant is variable, so the caller's own set bounds it: this route
grants the default scopes the caller holds, or the subset the body
names. A general credential therefore mints the nine defaults exactly
as before, and a narrowed one renews itself instead of widening.

The caller's remaining life bounds the lifetime the same way. The
ceiling is the earlier of the route's 30 days and that remainder, so
an over-long ``expires_in`` still reads 400, and a caller with no
expiry still reads the 30-day answer.

## Headers

- `authorization` string, nullable

## Request body

- CreateCredentialsRequest
  - `scopes` string[], nullable
  - `expires_in` integer, nullable

## Response `200`

Successful Response

- CredentialsResponse
  - `token` string, required
  - `username` string, required
  - `expires_at` string, date-time, required
  - `scopes` string[], required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)