---
title: "Create Credentials"
method: POST
path: "/credentials"
tags: ["Configuration"]
---

# Create Credentials

`POST /credentials`

Create a set of new cloud provider, kubernetes, vault or cost credentials for an Organization which may then be associated with a Project

## Request body

- ConfigurationApiCreateCredentialRequestBody
  - `organizationId` string
  - `projectId` string
  - `type` 'AWS_ASSUMED_ROLE' | 'AWS_ASSUMED_ROLE_FOR_DEPLOYMENT' | 'AWS_ACCESS_KEYS_FOR_DEPLOYMENT' | 'AWS_OIDC' | 'GCP_CREDENTIALS' | 'GCP_SERVICE_ACCOUNT_FOR_DEPLOYMENT' | 'GCP_OIDC' | 'AZURE_CREDENTIALS' | 'AZURE_SERVICE_PRINCIPAL_FOR_DEPLOYMENT' | 'AZURE_OIDC' | 'K8S_KUBECONFIG_FILE' | 'K8S_EKS_AUTH' | 'K8S_AZURE_AKS_AUTH' | 'K8S_GCP_GKE_AUTH' | 'VAULT_OIDC' | 'OCI_API_KEY_FOR_DEPLOYMENT' | 'AWS_ASSUMED_ROLE' | 'AWS_ASSUMED_ROLE_FOR_DEPLOYMENT' | 'AWS_ACCESS_KEYS_FOR_DEPLOYMENT' | 'AWS_OIDC' | 'GCP_CREDENTIALS' | 'GCP_SERVICE_ACCOUNT_FOR_DEPLOYMENT' | 'GCP_OIDC' | 'AZURE_CREDENTIALS' | 'AZURE_SERVICE_PRINCIPAL_FOR_DEPLOYMENT' | 'AZURE_OIDC' | 'K8S_KUBECONFIG_FILE' | 'K8S_EKS_AUTH' | 'K8S_AZURE_AKS_AUTH' | 'K8S_GCP_GKE_AUTH' | 'VAULT_OIDC' | 'OCI_API_KEY_FOR_DEPLOYMENT', required
  - `createdByUser` User
    - `email` string
    - `user_id` string
    - `created_at` string
    - `updated_at` string
    - `app_metadata` AppMetadata
      - `organizations` UserOrganization[]
        - `id` string, required
        - `role` string
        - `name` string
      - `isApiKey` boolean
      - `isAutogeneratedTerraformDeployer` boolean
      - `apiKeyType` 'oidc'
      - `createdBy` string
      - `organizationId` string
      - `isSystemUser` boolean
      - `readOnly` boolean
    - `picture` string
    - `name` string
    - `last_login` string
    - `given_name` string
    - `family_name` string
    - `blocked` boolean
  - `value` object, required — A JSON representation of the provider credentials. - For AWS_ASSUMED_ROLE_FOR_DEPLOYMENT and AWS_ASSUMED_ROLE types use: { roleArn: "your-role-arn", duration?: "duration-in-seconds" } - For GCP_CREDENTIALS type use: { tableId: "your-table-id", secret: "your-secret" } - For AZURE_CREDENTIALS type use: { clientId: "your-clientId", clientSecret: "your-clientSecret", tenantId: "your-tenantId", subscriptionId: "your-subscriptionId" } - For AWS_ACCESS_KEYS_FOR_DEPLOYMENT type use: { accessKeyId: "your-access-key-id", secretAccessKey: "your-secret-access-key" } - For AWS_OIDC type use: { roleArn: "your-role-arn", duration?: "duration-in-seconds", tokenFormat?: "v1" | "v2" } - For AZURE_OIDC type use: { clientId: "your-clientId", tenantId: "your-tenantId", subscriptionId: "your-subscriptionId", tokenFormat?: "v1" | "v2" } - For GCP_SERVICE_ACCOUNT_FOR_DEPLOYMENT type use: { serviceAccountKey: "your-service-account-key", projectId?: "your-project-id" } - For GCP_OIDC type use: { credentialConfigurationFileContent: "your-credential-configuration-file-content", tokenFormat?: "v1" | "v2" } - For K8S_KUBECONFIG_FILE type use: { kubeConfig: "your-kube-config" } - For K8S_EKS_AUTH type use: { clusterName: "your-cluster-name", clusterRegion: "your-cluster-region" } - For K8S_AZURE_AKS_AUTH type use: { clusterName: "your-cluster-name", resourceGroup: "your-resource-group" } - For K8S_GCP_GKE_AUTH type use: { clusterName: "your-cluster-name", computeRegion: "your-compute-region" } - For VAULT_OIDC type use: { roleName: "your-role-name", namespace?: "your-namespace", address: "your-address", version: "your-version", jwtAuthBackendPath: "your-jwt-auth-backend-path", tokenFormat?: "v1" | "v2" } - For OCI_API_KEY_FOR_DEPLOYMENT type use: { tenancyOcid: "your-tenancy-ocid", userOcid: "your-user-ocid", fingerprint: "your-fingerprint", privateKey: "your-private-key", region: "your-region" }
  - `encryptionMethod` 'kms'
  - `name` string, required

## Response `200`

- ConfigurationApiCreateCredentialResponse
  - `type` 'AWS_ASSUMED_ROLE' | 'AWS_ASSUMED_ROLE_FOR_DEPLOYMENT' | 'AWS_ACCESS_KEYS_FOR_DEPLOYMENT' | 'AWS_OIDC' | 'GCP_CREDENTIALS' | 'GCP_SERVICE_ACCOUNT_FOR_DEPLOYMENT' | 'GCP_OIDC' | 'AZURE_CREDENTIALS' | 'AZURE_SERVICE_PRINCIPAL_FOR_DEPLOYMENT' | 'AZURE_OIDC' | 'K8S_KUBECONFIG_FILE' | 'K8S_EKS_AUTH' | 'K8S_AZURE_AKS_AUTH' | 'K8S_GCP_GKE_AUTH' | 'VAULT_OIDC' | 'OCI_API_KEY_FOR_DEPLOYMENT' | 'AWS_ASSUMED_ROLE' | 'AWS_ASSUMED_ROLE_FOR_DEPLOYMENT' | 'AWS_ACCESS_KEYS_FOR_DEPLOYMENT' | 'AWS_OIDC' | 'GCP_CREDENTIALS' | 'GCP_SERVICE_ACCOUNT_FOR_DEPLOYMENT' | 'GCP_OIDC' | 'AZURE_CREDENTIALS' | 'AZURE_SERVICE_PRINCIPAL_FOR_DEPLOYMENT' | 'AZURE_OIDC' | 'K8S_KUBECONFIG_FILE' | 'K8S_EKS_AUTH' | 'K8S_AZURE_AKS_AUTH' | 'K8S_GCP_GKE_AUTH' | 'VAULT_OIDC' | 'OCI_API_KEY_FOR_DEPLOYMENT', required
  - `createdByUser` User
    - `email` string
    - `user_id` string
    - `created_at` string
    - `updated_at` string
    - `app_metadata` AppMetadata
      - `organizations` UserOrganization[]
        - `id` string, required
        - `role` string
        - `name` string
      - `isApiKey` boolean
      - `isAutogeneratedTerraformDeployer` boolean
      - `apiKeyType` 'oidc'
      - `createdBy` string
      - `organizationId` string
      - `isSystemUser` boolean
      - `readOnly` boolean
    - `picture` string
    - `name` string
    - `last_login` string
    - `given_name` string
    - `family_name` string
    - `blocked` boolean
  - `value` unknown, required
  - `id` string, required
  - `name` string, required
  - `organizationId` string, required
  - `projectId` string
  - `updatedAt` string, date-time, required

---

[API](https://skmtc.net/envzero/apis/env0-api.md) · [All operations](https://skmtc.net/envzero/apis/env0-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/envzero/env0-api/versions/513441cbe9dc/schema)