API Referencecredentials

Update Credential

Beta

Rotate a credential’s secret and/or rename it, in place, keeping the same id so every referencing config picks up the change with no re-wiring. Because the vault is write-only, rotation is the only way to change a stored secret. The kind is immutable: a rotated config must populate the same block as the credential’s existing kind.

Authentication

AuthorizationBearer

Enter your API key with the Bearer prefix, e.g. ‘Bearer sk_…’.

Path parameters

idstringRequired

Credential id (prefixed external id, cred_...).

Headers

Speechify-VersionstringOptional

Request

This endpoint expects an object.
namestringOptional

New human-readable label, unique per workspace.

configobjectOptional

Kind-specific credential payload, used on WRITES only (create and rotate). Exactly one block is populated — the one named by the credential’s kind. The secret fields are write-only: they are accepted here but are NEVER returned on reads — a read returns the masked CredentialConfigView instead.

Response

The updated credential.
idstring

Workspace-scoped credential identifier (prefixed external id).

namestring

Human-readable label, unique per workspace among active credentials.

kindenum

Discriminates the auth flow a credential carries. The matching config.<kind> block is the one that must be populated.

configobject

The masked, read-safe projection of a credential’s config. Returned on every read (list / get / create / rotate response). Non-secret fields (token URLs, client ids, issuer, header names) pass through; each secret is replaced by a *_set boolean. Secret values are never returned — to change one, rotate it via PATCH /v1/credentials/{id}. Exactly one block is populated, matching the credential’s kind.

created_atdatetime
updated_atdatetime

Errors

400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
409
Conflict Error