---
title: "Create Integration Instance Auth Credential"
method: POST
path: "/v1/integration-instances/{integrationInstanceId}/auth-credential"
tags: ["Integration Instance Auth Credentials"]
---

# Create Integration Instance Auth Credential

`POST /v1/integration-instances/{integrationInstanceId}/auth-credential`

Creates an auth credential scoped to the given integration instance.
Auth credentials are singleton resources that have a 1-to-1 relationship with
an integration instance.

An attempt to create subsequent auth credentials for an instance will result in a 409 response.

## Request body

- CreateIntegrationInstanceAuthCredential — Payload used to create an `Multi Key` credential for an integration instance.
  - `type` 'multi_key_auth', required
  - `config` object, required
    - `headers` object[], required — A list of header key/value pairs used to transmit API credentials to the integration's external API. Header names are defined by the integration within its `Multi Key` authorization strategy definition.
      - `name` string, required — Name of the request header
      - `key` string, required — The key used to populate the request header

## Response `201`

A response containing an integration instance auth credential.

- IntegrationInstanceAuthCredential — Represents a credential scoped to an integration instance that supports the `Multi Key` authorization strategy.
  - `id` string, uuid, required
  - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
    - `id` string, uuid, required — The integration instance ID.
    - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
    - `display_name` string, required — The display name of the integration instance.
  - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
    - `scopes` string[], required
    - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
  - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
  - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `type` 'multi_key_auth', required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `409` — Conflict

---

[API](https://skmtc.net/kong/apis/konnect-api.md) · [All operations](https://skmtc.net/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/06734a9c491f/schema)