---
title: "POST /identities/CreateApiKeyCredentialProvider"
method: POST
path: "/identities/CreateApiKeyCredentialProvider"
---

# POST /identities/CreateApiKeyCredentialProvider

`POST /identities/CreateApiKeyCredentialProvider`

Creates a new API key credential provider.

## Request body

- object
  - `name` string, required — The name of the API key credential provider. The name must be unique within your account.
  - `apiKey` string, password — The API key to use for authentication. This value is encrypted and stored securely.
  - `apiKeySecretConfig` object — Contains a reference to a secret stored in Amazon Web Services Secrets Manager.
    - `secretId` string — The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
    - `jsonKey` string — The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
  - `apiKeySecretSource` 'MANAGED' | 'EXTERNAL' — The source type of the API key secret. Use <code>MANAGED</code> if the secret is managed by the service, or <code>EXTERNAL</code> if you manage the secret yourself in Amazon Web Services Secrets Manager.
  - `tags` object — A map of tag keys and values to assign to the API key credential provider. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.

## Response `201`

Success

- CreateApiKeyCredentialProviderResponse
  - `apiKeySecretArn` object, required — The Amazon Resource Name (ARN) of the secret containing the API key.
    - `secretArn` string, required — The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
  - `apiKeySecretJsonKey` string — The JSON key used to extract the API key value from the Amazon Web Services Secrets Manager secret.
  - `apiKeySecretSource` 'MANAGED' | 'EXTERNAL' — The source type of the API key secret. Either <code>MANAGED</code> if the secret is managed by the service, or <code>EXTERNAL</code> if managed by the user in Amazon Web Services Secrets Manager.
  - `name` string, required — The name of the created API key credential provider.
  - `credentialProviderArn` string, required — The Amazon Resource Name (ARN) of the created API key credential provider.

## Other responses

- `480` — ServiceQuotaExceededException
- `481` — UnauthorizedException
- `482` — ResourceLimitExceededException
- `483` — ValidationException
- `484` — ConflictException
- `485` — AccessDeniedException
- `486` — DecryptionFailure
- `487` — ResourceNotFoundException
- `488` — ThrottlingException
- `489` — InternalServerException
- `490` — EncryptionFailure

---

[API](https://skmtc.net/aws/apis/bedrock-agentcore-control.md) · [All operations](https://skmtc.net/aws/apis/bedrock-agentcore-control/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/bedrock-agentcore-control/versions/0ebde766792b/schema)