API ReferenceCredentials

Create Credential

Beta
Create a credential in the caller's workspace vault. `config` must carry exactly the one kind-specific block named by `kind` (e.g. `kind=bearer` requires `config.bearer`). Names are unique per workspace among active credentials. The response never carries the secret back: it returns the masked config with `*_set` markers. This is the first step of connecting an MCP server or a vendor's REST API: reference the returned `id` as `auth.credential_id` on an `mcp` or `openapi` tool (and on `import-openapi` when the vendor's document sits behind the same auth). A credential with no `project_id` is shared by every project; one scoped to a project can only back tools in that project. See `CredentialKind` for what each kind backs.

Authentication

AuthorizationBearer

Enter your API key with the Bearer prefix, e.g. ‘Bearer sk_…’.

Headers

Speechify-VersionstringOptional

Request

This endpoint expects an object.
namestringRequired

Human-readable label, unique per workspace.

kindenumRequired

Discriminates the auth flow a credential carries. The matching config.<kind> block is the one that must be populated, and the only one.

  • oauth2_client_credentials: a client_id and client_secret the platform exchanges at the vendor’s token_url for a short-lived access token (the OAuth2 client-credentials flow). Backs an mcp or openapi tool whose auth.type is oauth2_client_credentials.
  • bearer: a static token sent as Authorization: Bearer <token>. Backs an mcp or openapi tool whose auth.type is bearer, an agent’s custom LLM endpoint key, a custom model’s key, and a messaging channel’s bot token.
  • shared_secret: a secret that is never sent anywhere; an inbound callback’s signature is verified against it, such as a messaging channel’s signing secret.
  • oauth2_jwt: a signing key for the JWT-bearer flow (RFC 7523).
  • basic: a username and password.
  • custom_headers: a set of header names and values.

The vault stores oauth2_jwt, basic and custom_headers, but no tool auth type references them yet: an mcp or openapi tool authenticates with bearer or oauth2_client_credentials only.

configobjectRequired

Kind-specific credential payload, used on WRITES only (create and rotate). Exactly one block is populated — the one named by the credential’s kind. The secret fields are write-only: they are accepted here but are NEVER returned on reads — a read returns the masked CredentialConfigView instead.

project_idstring or nullOptional

Optional project to scope this credential to (prefixed proj_... id): a scoped credential is referenceable only from tools in that project. Omit (or null) for workspace-shared - usable from every project. An unknown id returns 404 project_not_found. A project-pinned API key creates into its own project and cannot name the shared tier.

Response headers

Speechify-Request-IdstringOptional
Unique identifier for this request, present on every response (2xx and non-2xx alike). If the caller sends a `Speechify-Request-Id` request header the server echoes it back (sanitized and length-capped) so one logical request can be traced end-to-end; otherwise the server generates a fresh value. Log it on every response and quote it in support requests - it is the stable handle that ties your observation to Speechify's server-side logs, and it matches the `request_id` field in the error envelope. The legacy alias `X-Request-ID` carries the same value and is still accepted on requests, until 2027-07-24. Prefer the un-prefixed name (RFC 6648).

Response

The created credential.
idstringformat: "^cred_[0-9a-hjkmnp-tv-z]{26}$"

Workspace-scoped credential identifier (prefixed external id).

namestring

Human-readable label, unique per workspace among active credentials.

kindenum

Discriminates the auth flow a credential carries. The matching config.<kind> block is the one that must be populated, and the only one.

  • oauth2_client_credentials: a client_id and client_secret the platform exchanges at the vendor’s token_url for a short-lived access token (the OAuth2 client-credentials flow). Backs an mcp or openapi tool whose auth.type is oauth2_client_credentials.
  • bearer: a static token sent as Authorization: Bearer <token>. Backs an mcp or openapi tool whose auth.type is bearer, an agent’s custom LLM endpoint key, a custom model’s key, and a messaging channel’s bot token.
  • shared_secret: a secret that is never sent anywhere; an inbound callback’s signature is verified against it, such as a messaging channel’s signing secret.
  • oauth2_jwt: a signing key for the JWT-bearer flow (RFC 7523).
  • basic: a username and password.
  • custom_headers: a set of header names and values.

The vault stores oauth2_jwt, basic and custom_headers, but no tool auth type references them yet: an mcp or openapi tool authenticates with bearer or oauth2_client_credentials only.

configobject

The masked, read-safe projection of a credential’s config. Returned on every read (list / get / create / rotate response). Non-secret fields (token URLs, client ids, issuer, header names) pass through; each secret is replaced by a *_set boolean. Secret values are never returned - to change one, rotate it via PATCH /v1/credentials/{credential_id}. Exactly one block is populated, matching the credential’s kind.

used_byobject

Dependency tracking for a credential: the resources that reference it, so a rotate/delete can’t silently break a live integration. count is the total; references lists them (empty when unreferenced).

created_atdatetime
updated_atdatetime
project_idstring or nullOptionalformat: "^proj_[0-9a-hjkmnp-tv-z]{26}$"

The project this credential is scoped to (prefixed external id). Null means workspace-shared - usable from every project. Credentials have no Default project.

Errors

400
Bad Request Error
401
Unauthorized Error
409
Conflict Error