---
title: "Create Integration Instance Auth Credential"
method: POST
path: "/v1/integration-instances/{integrationInstanceId}/auth-credential"
tags: ["Integration Instance Auth Credentials"]
---

# Create Integration Instance Auth Credential

`POST /v1/integration-instances/{integrationInstanceId}/auth-credential`

Creates an auth credential scoped to the given integration instance.
Auth credentials are singleton resources that have a 1-to-1 relationship with
an integration instance.

An attempt to create subsequent auth credentials for an instance will result in a 409 response.

## Request body

- union
  - CreateOAuthCredential — Payload used to create an `OAuth` credential for an integration instance.
    - `type` 'oauth', required
    - `config` object, required
      - `grant_type` 'authorization_code', required — The OAuth 2.0 grant type used for authorization (e.g., `authorization_code`).
      - `code` string, required — The authorization code used to exchange for an access token with the identity server.
      - `redirect_uri` string, uri, required — The redirect URI submitted to the authorization server during the authentication request to retrieve the authorization code.
  - CreateGitHubAppInstallationCredential — Payload used to create an `GitHub App Installation` credential for an integration instance.
    - `type` 'github_app_installation', required
    - `config` object, required
      - `installation_id` string, required — The GitHub App installation ID.
      - `code` string, required — The authorization code used to exchange for a GitHub user-scoped access token.
      - `app_installed_by` string — The GitHub user who installed the app
  - CreateMultiKeyAuthCredential — Payload used to create an `Multi Key` credential for an integration instance.
    - `type` 'multi_key_auth', required
    - `config` object, required
      - `headers` object[], required — A list of header key/value pairs used to transmit API credentials to the integration's external API. Header names are defined by the integration within its `Multi Key` authorization strategy definition.
        - `name` string, required — Name of the request header
        - `key` string, required — The key used to populate the request header
  - CreateAWSRoleDelegationAuthCredential — Payload used to create an `AWS Role Delegation` credential for an integration instance.
    - `type` 'aws_role_delegation', required
    - `config` object, required
      - `role_arn` string, required — The AWS Role ARN string

## Response `201`

A response containing an integration instance auth credential.

- union — Object containing metadata for an integration instance auth credential.
  - OAuthCredential — Represents a credential scoped to an integration instance that supports the `OAuth` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'oauth', required
  - GitHubAppInstallationCredential — Represents a credential scoped to an integration instance that supports the `GitHub App Installation` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'github_app_installation', required
    - `config` object, required
      - `installation_id` string, required — The GitHub App installation ID
      - `app_installed_by` string, nullable, required — The GitHub user who installed the app.
  - MultiKeyAuthCredential — Represents a credential scoped to an integration instance that supports the `Multi Key` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'multi_key_auth', required
  - AWSRoleDelegationAuthCredential — Represents a credential scoped to an integration instance that supports the `AWS Role Delegation` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'aws_role_delegation', required
    - `config` object, required
      - `role_arn` string, required — The Role ARN use for AWS Assume Role.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `409` — Conflict

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/0261aef4b1e2/schema)