Update Credential | SpeechifyAI API

curl -X PATCH https://api.speechify.ai/v1/credentials/cred_01jqr8x9zg5k2m3n4p5q6r7s8t \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "config": {
    "oauth2_client_credentials": {
      "token_url": "https://auth.vendor.example/oauth/token",
      "client_id": "9f3c1e7a2b4d4c8e",
      "client_secret": "<new-client-secret>",
      "scopes": [
        "issues:read"
      ],
      "token_endpoint_auth_method": "client_secret_basic"
    }
  }
}'

{
  "id": "cred_01kc4p2q8r5s7t9v1w3x5y7z9a",
  "name": "Vendor API client",
  "kind": "oauth2_client_credentials",
  "config": {
    "oauth2_client_credentials": {
      "token_url": "https://auth.vendor.example/oauth/token",
      "client_id": "9f3c1e7a2b4d4c8e",
      "client_secret_set": true,
      "scopes": [
        "issues:read"
      ],
      "token_endpoint_auth_method": "client_secret_basic"
    }
  },
  "used_by": {
    "count": 1,
    "references": [
      {
        "resource_type": "tool",
        "id": "tool_01kc4m8r2t6v9x3z5b7d1f3h5k",
        "name": "vendor_issues"
      }
    ]
  },
  "created_at": "2026-06-24T18:03:11Z",
  "updated_at": "2026-06-24T18:03:11Z",
  "project_id": null
}

Rotate a credential’s secret and/or rename it, in place, keeping the same id so every referencing config picks up the change with no re-wiring. Because the vault is write-only, rotation is the only way to change a stored secret. The kind is immutable: a rotated config must populate the same block as the credential’s existing kind.

Authentication

AuthorizationBearer

Enter your API key with the Bearer prefix, e.g. ‘Bearer sk_…’.

Path parameters

credential_idstringRequired

Credential id (prefixed external id, cred_...).

Request

This endpoint expects an object.

namestringOptional

New human-readable label, unique per workspace.

project_idstring or nullOptional

Move the credential between scopes: a proj_... id scopes it to that project, an explicit null makes it workspace-shared, omitted leaves it unchanged. Scoping to a project is refused with 409 cross_project_reference while tools or agents outside that project still reference the credential (the response lists them); making it shared always succeeds. A project-pinned API key may only scope a credential to its own project.

configobjectOptional

Kind-specific credential payload, used on WRITES only (create and rotate). Exactly one block is populated — the one named by the credential’s kind. The secret fields are write-only: they are accepted here but are NEVER returned on reads — a read returns the masked CredentialConfigView instead.

Response headers

Speechify-Request-IdstringOptional

Unique identifier for this request, present on every response (2xx and non-2xx alike). If the caller sends a Speechify-Request-Id request header the server echoes it back (sanitized and length-capped) so one logical request can be traced end-to-end; otherwise the server generates a fresh value. Log it on every response and quote it in support requests

it is the stable handle that ties your observation to Speechify’s server-side logs, and it matches the request_id field in the error envelope.

The legacy alias X-Request-ID carries the same value and is still accepted on requests, until 2027-07-24. Prefer the un-prefixed name (RFC 6648).

Unique identifier for this request, present on every response (2xx and non-2xx alike). If the caller sends a `Speechify-Request-Id` request header the server echoes it back (sanitized and length-capped) so one logical request can be traced end-to-end; otherwise the server generates a fresh value. Log it on every response and quote it in support requests - it is the stable handle that ties your observation to Speechify's server-side logs, and it matches the `request_id` field in the error envelope. The legacy alias `X-Request-ID` carries the same value and is still accepted on requests, until 2027-07-24. Prefer the un-prefixed name (RFC 6648).

Response

The updated credential.

idstringformat: "^cred_[0-9a-hjkmnp-tv-z]{26}$"

Workspace-scoped credential identifier (prefixed external id).

namestring

Human-readable label, unique per workspace among active credentials.

kindenum

Discriminates the auth flow a credential carries. The matching config.<kind> block is the one that must be populated, and the only one.

oauth2_client_credentials: a client_id and client_secret the platform exchanges at the vendor’s token_url for a short-lived access token (the OAuth2 client-credentials flow). Backs an mcp or openapi tool whose auth.type is oauth2_client_credentials.
bearer: a static token sent as Authorization: Bearer <token>. Backs an mcp or openapi tool whose auth.type is bearer, an agent’s custom LLM endpoint key, a custom model’s key, and a messaging channel’s bot token.
shared_secret: a secret that is never sent anywhere; an inbound callback’s signature is verified against it, such as a messaging channel’s signing secret.
oauth2_jwt: a signing key for the JWT-bearer flow (RFC 7523).
basic: a username and password.
custom_headers: a set of header names and values.

The vault stores oauth2_jwt, basic and custom_headers, but no tool auth type references them yet: an mcp or openapi tool authenticates with bearer or oauth2_client_credentials only.

configobject

The masked, read-safe projection of a credential’s config. Returned on every read (list / get / create / rotate response). Non-secret fields (token URLs, client ids, issuer, header names) pass through; each secret is replaced by a *_set boolean. Secret values are never returned - to change one, rotate it via PATCH /v1/credentials/{credential_id}. Exactly one block is populated, matching the credential’s kind.

used_byobject

Dependency tracking for a credential: the resources that reference it, so a rotate/delete can’t silently break a live integration. count is the total; references lists them (empty when unreferenced).

created_atdatetime

updated_atdatetime

project_idstring or nullOptionalformat: "^proj_[0-9a-hjkmnp-tv-z]{26}$"

The project this credential is scoped to (prefixed external id). Null means workspace-shared - usable from every project. Credentials have no Default project.

Errors

400

Bad Request Error

401

Unauthorized Error

404

Not Found Error

409

Conflict Error