---
title: "Update credential"
method: PATCH
path: "/credentials/{id_or_name}"
tags: ["Credentials"]
---

# Update credential

`PATCH /credentials/{id_or_name}`

Update a credential's name or values. When values are provided, they are merged with existing values (new keys are added, existing keys are overwritten).

## Path parameters

- `id_or_name` string, required

## Request body

- UpdateCredentialRequest — Request to update an existing credential
  - `name` string — New name for the credential
  - `values` object — Field name to value mapping. Values are merged with existing values (new keys added, existing keys overwritten).
  - `remove_value_keys` string[] — Field names to remove from the credential's stored values. Removals are applied before `values` are merged, so a key present in both is kept with its new value.
  - `totp_secret` string — Base32-encoded TOTP secret for generating one-time passwords. Spaces and formatting are automatically normalized. Set to empty string to remove.
  - `sso_provider` string, nullable — If set, indicates this credential should be used with the specified SSO provider. Set to empty string or null to remove.

## Response `200`

Credential updated successfully

- Credential — A stored credential for automatic re-authentication
  - `id` string, required — Unique identifier for the credential
  - `name` string, required — Unique name for the credential within the project
  - `domain` string, required — Target domain this credential is for
  - `created_at` string, date-time, required — When the credential was created
  - `updated_at` string, date-time, required — When the credential was last updated
  - `has_values` boolean — Whether this credential has stored values (email, password, etc.)
  - `has_totp_secret` boolean — Whether this credential has a TOTP secret configured for automatic 2FA
  - `value_keys` string[] — The field names stored in this credential's values (e.g., username, password). Values themselves are never returned. Included on single-credential responses (create, get by id or name, update); omitted from list responses.
  - `sso_provider` string, nullable — If set, indicates this credential should be used with the specified SSO provider (e.g., google, github, microsoft). When the target site has a matching SSO button, it will be clicked first before filling credential values on the identity provider's login page.
  - `totp_code` string — Current 6-digit TOTP code. Only included in create/update responses when totp_secret was just set.
  - `totp_code_expires_at` string, date-time — When the totp_code expires. Only included when totp_code is present.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `403` — Forbidden – insufficient permissions or plan
- `404` — Resource not found
- `409` — Conflict – resource already exists
- `500` — Internal Server Error

---

[API](https://skmtc.net/kernel/apis/kernel-api.md) · [All operations](https://skmtc.net/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kernel/kernel-api/versions/9e8ce9fcf5e1/schema)