---
title: "Retrieve Credentials for a Kubernetes Cluster"
method: GET
path: "/v2/kubernetes/clusters/{cluster_id}/credentials"
tags: ["DigitalOcean-public.v2-new_Kubernetes"]
---

# Retrieve Credentials for a Kubernetes Cluster

`GET /v2/kubernetes/clusters/{cluster_id}/credentials`

This endpoint returns a JSON object . It can be used to programmatically
construct Kubernetes clients which cannot parse kubeconfig files.

The resulting JSON object contains token-based authentication for clusters
supporting it, and certificate-based authentication otherwise. For a list of
supported versions and more information, see "[How to Connect to a DigitalOcean
Kubernetes Cluster](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/)".

To retrieve credentials for accessing a Kubernetes cluster, send a GET
request to `/v2/kubernetes/clusters/$K8S_CLUSTER_ID/credentials`.

Clusters supporting token-based authentication may define an expiration by
passing a duration in seconds as a query parameter to
`/v2/kubernetes/clusters/$K8S_CLUSTER_ID/credentials?expiry_seconds=$DURATION_IN_SECONDS`.
If not set or 0, then the token will have a 7 day expiry. The query parameter
has no impact in certificate-based authentication.

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `expiry_seconds` integer

## Response `200`

A JSON object containing credentials for a cluster.

- Credentials
  - `server` string, uri — The URL used to access the cluster API server.
  - `certificate_authority_data` string, byte — A base64 encoding of bytes representing the certificate authority data for accessing the cluster.
  - `client_certificate_data` string, byte, nullable — A base64 encoding of bytes representing the x509 client certificate data for access the cluster. This is only returned for clusters without support for token-based authentication. Newly created Kubernetes clusters do not return credentials using certificate-based authentication. For additional information, [see here](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/#authenticate).
  - `client_key_data` string, byte, nullable — A base64 encoding of bytes representing the x509 client key data for access the cluster. This is only returned for clusters without support for token-based authentication. Newly created Kubernetes clusters do not return credentials using certificate-based authentication. For additional information, [see here](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/#authenticate).
  - `token` string — An access token used to authenticate with the cluster. This is only returned for clusters with support for token-based authentication.
  - `expires_at` string, date-time — A time value given in ISO8601 combined date and time format that represents when the access token expires.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

---

[API](https://skmtc.net/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.net/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/revisions/cb3bf9b21459/schema)