---
title: "Issue a scoped credential on the branch"
method: POST
path: "/projects/{project_id}/branches/{branch_id}/credentials"
tags: ["Credentials"]
---

# Issue a scoped credential on the branch

`POST /projects/{project_id}/branches/{branch_id}/credentials`

Issues a new scoped service credential anchored to the specified
branch. The response carries `api_token` and `s3_secret_access_key`
exactly once — they are not stored server-side.

**Note**: This endpoint is currently in Private Beta.

## Request body

- CreateCredentialRequest
  - `name` string — Free-form customer label for the credential.
  - `scopes` CredentialScope[], required
  - `principal_type` 'user', required — Principal type for the credential. Only `user` is customer-managed and accepted here. `function` and `system` credentials are platform-internal (e.g. function-serve auto-mint, presign signer) and are never issued through the customer-facing API.

## Response `201`

Credential issued — secrets shown once.

- CreateCredentialResponse
  - `token_id` string, required — Opaque credential id (e.g. nak_live_<32hex>).
  - `token_id_short` string, required — First 12 hex chars of token_id; safe to log.
  - `name` string — Customer-supplied label, echoed back from the request. Absent when not provided.
  - `api_token` string, required — Bearer token; returned exactly once.
  - `s3_secret_access_key` string, required — nsk_live_<64 hex>; the AWS_SECRET_ACCESS_KEY, returned exactly once.
  - `scopes` CredentialScope[], required
  - `branch_id` string, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time — When the credential expires; absent means never expires.

## Other responses

- `default` — General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

---

[API](https://skmtc.net/neon/apis/neon-api.md) · [All operations](https://skmtc.net/neon/apis/neon-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neon/neon-api/revisions/cfde79a5c713/schema)