---
title: "Create a credential"
method: POST
path: "/credentials"
tags: ["Credentials"]
---

# Create a credential

`POST /credentials`

Create a new credential for storing login information.

## Request body

- CreateCredentialRequest — Request to create a new credential
  - `name` string, required — Unique name for the credential within the project
  - `domain` string, required — Target domain this credential is for
  - `values` object, required — Field name to value mapping (e.g., username, password)
  - `totp_secret` string — Base32-encoded TOTP secret for generating one-time passwords. Used for automatic 2FA during login.
  - `sso_provider` string — If set, indicates this credential should be used with the specified SSO provider (e.g., google, github, microsoft). When the target site has a matching SSO button, it will be clicked first before filling credential values on the identity provider's login page.

## Response `201`

Credential created successfully

- Credential — A stored credential for automatic re-authentication
  - `id` string, required — Unique identifier for the credential
  - `name` string, required — Unique name for the credential within the project
  - `domain` string, required — Target domain this credential is for
  - `created_at` string, date-time, required — When the credential was created
  - `updated_at` string, date-time, required — When the credential was last updated
  - `has_values` boolean — Whether this credential has stored values (email, password, etc.)
  - `has_totp_secret` boolean — Whether this credential has a TOTP secret configured for automatic 2FA
  - `value_keys` string[] — The field names stored in this credential's values (e.g., username, password). Values themselves are never returned. Included on single-credential responses (create, get by id or name, update); omitted from list responses.
  - `sso_provider` string, nullable — If set, indicates this credential should be used with the specified SSO provider (e.g., google, github, microsoft). When the target site has a matching SSO button, it will be clicked first before filling credential values on the identity provider's login page.
  - `totp_code` string — Current 6-digit TOTP code. Only included in create/update responses when totp_secret was just set.
  - `totp_code_expires_at` string, date-time — When the totp_code expires. Only included when totp_code is present.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `403` — Forbidden – insufficient permissions or plan
- `409` — Conflict – resource already exists
- `500` — Internal Server Error

---

[API](https://skmtc.net/kernel/apis/kernel-api.md) · [All operations](https://skmtc.net/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kernel/kernel-api/versions/9e8ce9fcf5e1/schema)