Skip to content

Create App Credential

POST
/apps/{app_id}/credentials

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Create a service credential for one consented client organization.

The secret is returned once and never again. Only its SHA-256 is stored — developer_app_credentials has no column that could hold a plaintext secret. Rotate by creating a new credential and revoking the old one.

The target organization must already have a consented installation of this app. A credential for a workspace that never consented would be a standing key into a tenant that never agreed to it, and the M6-1d clamp would refuse every request it minted anyway — failing here says why, instead of leaving a credential that silently cannot work.

Authorizations

Parameters

Path Parameters

app_id
required
string

Header Parameters

X-Org-Id
Any of:
string

Request Body required

A builder minting a service credential for one consented tenant.

object
client_org_id
required

The client organization this credential acts for. It must already have a consented installation of the app — a credential is bound to one tenant and cannot be pointed at another later.

string

Responses

201

Successful Response

object
data
required

The create response, and the ONLY time the secret is ever returned.

Only the SHA-256 is stored — developer_app_credentials has no column that could hold a plaintext secret — so this response cannot be reissued. That is the point: a secret the platform can re-read is a secret the platform can leak.

object
app_id
required
string
client_id
required
string
client_org_id
required
string
client_secret
required

Shown ONCE. Store it now — only its hash is kept, so it cannot be retrieved again. Rotate by creating a new credential and revoking this one.

string
created_at
Any of:
string format: date-time
revoked
boolean
pagination
Any of:
object
has_next
required

Whether there are more pages

boolean
limit
required

Items per page

integer
next_cursor
Any of:
string
page
required

Current page number (1-indexed)

integer
total
required

Total number of items

integer

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string