API ReferenceCredentials

Get Credential

Beta

Fetch one credential by id, scoped to the caller’s workspace. config is the masked CredentialConfigView — secret values are never returned. Returns 404 for missing, soft-deleted, or foreign-workspace credentials — credential existence is never leaked across workspaces.

Authentication

AuthorizationBearer

Enter your API key with the Bearer prefix, e.g. ‘Bearer sk_…’.

Path parameters

credential_idstringRequired

Credential id (prefixed external id, cred_...).

Headers

Speechify-VersionstringOptional

Response headers

Speechify-Request-IdstringOptional
Unique identifier for this request, present on every response (2xx and non-2xx alike). If the caller sends a `Speechify-Request-Id` request header the server echoes it back (sanitized and length-capped) so one logical request can be traced end-to-end; otherwise the server generates a fresh value. Log it on every response and quote it in support requests - it is the stable handle that ties your observation to Speechify's server-side logs, and it matches the `request_id` field in the error envelope. The legacy alias `X-Request-ID` carries the same value and is still accepted on requests, until 2027-07-24. Prefer the un-prefixed name (RFC 6648).

Response

The credential.
idstringformat: "^cred_[0-9a-hjkmnp-tv-z]{26}$"

Workspace-scoped credential identifier (prefixed external id).

namestring

Human-readable label, unique per workspace among active credentials.

kindenum

Discriminates the auth flow a credential carries. The matching config.<kind> block is the one that must be populated, and the only one.

  • oauth2_client_credentials: a client_id and client_secret the platform exchanges at the vendor’s token_url for a short-lived access token (the OAuth2 client-credentials flow). Backs an mcp or openapi tool whose auth.type is oauth2_client_credentials.
  • bearer: a static token sent as Authorization: Bearer <token>. Backs an mcp or openapi tool whose auth.type is bearer, an agent’s custom LLM endpoint key, a custom model’s key, and a messaging channel’s bot token.
  • shared_secret: a secret that is never sent anywhere; an inbound callback’s signature is verified against it, such as a messaging channel’s signing secret.
  • oauth2_jwt: a signing key for the JWT-bearer flow (RFC 7523).
  • basic: a username and password.
  • custom_headers: a set of header names and values.

The vault stores oauth2_jwt, basic and custom_headers, but no tool auth type references them yet: an mcp or openapi tool authenticates with bearer or oauth2_client_credentials only.

configobject

The masked, read-safe projection of a credential’s config. Returned on every read (list / get / create / rotate response). Non-secret fields (token URLs, client ids, issuer, header names) pass through; each secret is replaced by a *_set boolean. Secret values are never returned - to change one, rotate it via PATCH /v1/credentials/{credential_id}. Exactly one block is populated, matching the credential’s kind.

used_byobject

Dependency tracking for a credential: the resources that reference it, so a rotate/delete can’t silently break a live integration. count is the total; references lists them (empty when unreferenced).

created_atdatetime
updated_atdatetime
project_idstring or nullOptionalformat: "^proj_[0-9a-hjkmnp-tv-z]{26}$"

The project this credential is scoped to (prefixed external id). Null means workspace-shared - usable from every project. Credentials have no Default project.

Errors

401
Unauthorized Error
404
Not Found Error