---
title: "Mint a callback credential"
method: POST
path: "/v1/exceptions/callbacks/credentials"
tags: ["Exception"]
---

# Mint a callback credential

`POST /v1/exceptions/callbacks/credentials`

Mints an opaque bearer token bound to the caller's tenant for authenticating inbound external-system exception callbacks, and returns the raw token ONCE. Only the token's SHA-256 hash is stored server-side.

## Request body

- MintCredentialRequest
  - `externalSystem` string — Optional operator-legible label for the external system this credential authenticates (e.g. "stripe", "billing-gw")

## Response `201`

Created

- CredentialSecretResponse
  - `createdAt` string, required — Mint time (RFC 3339, UTC)
  - `credentialId` string, uuid, required — Surrogate id of the minted credential
  - `externalSystem` string — Operator-legible external-system label, echoed for confirmation
  - `token` string, required — Raw bearer token, surfaced exactly once; configure it as the X-Callback-Token header value in the external system. Only its SHA-256 hash is stored server-side.
  - `webhookUrlHint` string — Informational inbound-callback URL shape to configure in the external system. The {exceptionId} placeholder is filled per callback.

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)