Repository Public
1---2title: Create Credential3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/create4---56# Create Credential78**POST** `/v1/vaults/{vault_id}/credentials`910Create Credential1112## Path parameters1314- `vault_id: string`1516## Headers1718- `"anthropic-beta": optional array of AnthropicBeta`1920 Optional header to specify the beta version(s) you want to use.2122 - `string`2324 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`2526 - `"message-batches-2024-09-24"`2728 - `"prompt-caching-2024-07-31"`2930 - `"computer-use-2024-10-22"`3132 - `"computer-use-2025-01-24"`3334 - `"pdfs-2024-09-25"`3536 - `"token-counting-2024-11-01"`3738 - `"token-efficient-tools-2025-02-19"`3940 - `"output-128k-2025-02-19"`4142 - `"files-api-2025-04-14"`4344 - `"mcp-client-2025-04-04"`4546 - `"mcp-client-2025-11-20"`4748 - `"dev-full-thinking-2025-05-14"`4950 - `"interleaved-thinking-2025-05-14"`5152 - `"code-execution-2025-05-22"`5354 - `"extended-cache-ttl-2025-04-11"`5556 - `"context-1m-2025-08-07"`5758 - `"context-management-2025-06-27"`5960 - `"model-context-window-exceeded-2025-08-26"`6162 - `"skills-2025-10-02"`6364 - `"fast-mode-2026-02-01"`6566 - `"output-300k-2026-03-24"`6768 - `"user-profiles-2026-03-24"`6970 - `"user-profiles-2026-08-18"`7172 - `"user-profiles-2026-09-04"`7374 - `"advisor-tool-2026-03-01"`7576 - `"managed-agents-2026-04-01"`7778 - `"cache-diagnosis-2026-04-07"`7980 - `"dreaming-2026-04-21"`8182 - `"thinking-token-count-2026-05-13"`8384 - `"server-side-fallback-2026-06-01"`8586 - `"server-side-fallback-2026-07-01"`8788 - `"fallback-credit-2026-06-01"`8990 - `"fallback-credit-2026-07-01"`9192 - `"agent-memory-2026-07-22"`9394 - `"mid-conversation-tool-changes-2026-07-01"`9596 - `"compact-2026-01-12"`9798 - `"computer-use-2025-11-24"`99100 - `"mcp-tunnels-2026-06-22"`101102 - `"structured-outputs-2025-11-13"`103104 - `"task-budgets-2026-03-13"`105106 - `"thinking-display-updates-2026-08-18"`107108 - `"ce-user-management-2026-07-13"`109110 - `"mid-conversation-output-config-2026-07-01"`111112 - `"thinking-binding-controls-2026-08-01"`113114 - `"mid-conversation-system-clear-at-2026-08-21"`115116 - `"compact-2026-09-04"`117118- `"anthropic-workspace-id": optional string`119120## Body parameters121122- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`123124 Authentication details for creating a credential.125126 - `BetaManagedAgentsMCPOAuthCreateParams object`127128 Parameters for creating an MCP OAuth credential.129130 - `type: "mcp_oauth"`131132 - `access_token: string`133134 OAuth access token.135136 minLength: 1, maxLength: 8192137138 - `mcp_server_url: string`139140 URL of the MCP server this credential authenticates against.141142 minLength: 1, maxLength: 2047143144 - `expires_at: optional string or null`145146 A timestamp in RFC 3339 format147148 format: date-time149150 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`151152 OAuth refresh token parameters for creating a credential with refresh support.153154 - `client_id: string`155156 OAuth client ID.157158 minLength: 1, maxLength: 1024159160 - `refresh_token: string`161162 OAuth refresh token.163164 minLength: 1, maxLength: 8192165166 - `token_endpoint: string`167168 Token endpoint URL used to refresh the access token.169170 minLength: 1, maxLength: 2047171172 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`173174 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`175176 Token endpoint requires no client authentication.177178 - `type: "none"`179180 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`181182 Token endpoint uses HTTP Basic authentication with client credentials.183184 - `type: "client_secret_basic"`185186 - `client_secret: string`187188 OAuth client secret.189190 minLength: 1, maxLength: 512191192 - `BetaManagedAgentsTokenEndpointAuthPostParam object`193194 Token endpoint uses POST body authentication with client credentials.195196 - `type: "client_secret_post"`197198 - `client_secret: string`199200 OAuth client secret.201202 minLength: 1, maxLength: 512203204 - `resource: optional string or null`205206 OAuth resource indicator.207208 minLength: 1, maxLength: 2047209210 - `scope: optional string or null`211212 OAuth scope for the refresh request.213214 minLength: 1, maxLength: 8192215216 - `BetaManagedAgentsStaticBearerCreateParams object`217218 Parameters for creating a static bearer token credential.219220 - `type: "static_bearer"`221222 - `token: string`223224 Static bearer token value.225226 minLength: 1, maxLength: 8192227228 - `mcp_server_url: string`229230 URL of the MCP server this credential authenticates against.231232 minLength: 1, maxLength: 2047233234 - `BetaManagedAgentsEnvironmentVariableCreateParams object`235236 Parameters for creating an environment variable credential.237238 - `type: "environment_variable"`239240 - `networking: BetaManagedAgentsCredentialNetworkingParams`241242 Outbound hosts the secret value is substituted on.243244 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`245246 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.247248 - `type: "unrestricted"`249250 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`251252 Substitute the secret only on requests to the listed hosts.253254 - `type: "limited"`255256 - `allowed_hosts: array of string`257258 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.259260 - `secret_name: string`261262 Name of the environment variable. Immutable after create.263264 minLength: 1, maxLength: 255265266 - `secret_value: string`267268 Secret value. Write-only; never returned in responses.269270 minLength: 1, maxLength: 4096271272 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`273274 Where in the outbound request the secret value may be substituted.275276 - `body: optional boolean`277278 Substitute when the placeholder appears in the request body.279280 - `header: optional boolean`281282 Substitute when the placeholder appears in a request header value.283284- `display_name: optional string or null`285286 Human-readable name for the credential. Up to 255 characters.287288 maxLength: 255289290- `metadata: optional map[string]`291292 Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.293294## Returns295296- `BetaManagedAgentsCredential object`297298 A credential stored in a vault. Sensitive fields are never returned in responses.299300 - `type: "vault_credential"`301302 - `id: string`303304 Unique identifier for the credential.305306 - `archived_at: string or null`307308 A timestamp in RFC 3339 format309310 format: date-time311312 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`313314 Authentication details for a credential.315316 - `BetaManagedAgentsMCPOAuthAuthResponse object`317318 OAuth credential details for an MCP server.319320 - `type: "mcp_oauth"`321322 - `mcp_server_url: string`323324 URL of the MCP server this credential authenticates against.325326 - `expires_at: optional string or null`327328 A timestamp in RFC 3339 format329330 format: date-time331332 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`333334 OAuth refresh token configuration returned in credential responses.335336 - `client_id: string`337338 OAuth client ID.339340 - `token_endpoint: string`341342 Token endpoint URL used to refresh the access token.343344 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`345346 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`347348 Token endpoint requires no client authentication.349350 - `type: "none"`351352 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`353354 Token endpoint uses HTTP Basic authentication with client credentials.355356 - `type: "client_secret_basic"`357358 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`359360 Token endpoint uses POST body authentication with client credentials.361362 - `type: "client_secret_post"`363364 - `resource: optional string or null`365366 OAuth resource indicator.367368 - `scope: optional string or null`369370 OAuth scope for the refresh request.371372 - `BetaManagedAgentsStaticBearerAuthResponse object`373374 Static bearer token credential details for an MCP server.375376 - `type: "static_bearer"`377378 - `mcp_server_url: string`379380 URL of the MCP server this credential authenticates against.381382 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`383384 Environment variable credential details. The secret value is never returned.385386 - `type: "environment_variable"`387388 - `injection_location: BetaManagedAgentsInjectionLocationResponse`389390 Where in the outbound request the secret value is substituted.391392 - `body: boolean`393394 Whether the placeholder is substituted in the request body.395396 - `header: boolean`397398 Whether the placeholder is substituted in request header values.399400 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`401402 Outbound hosts the secret value is substituted on.403404 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`405406 The secret is substituted on any host the session's Environment network policy permits egress to.407408 - `type: "unrestricted"`409410 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`411412 The secret is substituted only on requests to the listed hosts.413414 - `type: "limited"`415416 - `allowed_hosts: array of string`417418 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.419420 - `secret_name: string`421422 Name of the environment variable.423424 - `created_at: string`425426 A timestamp in RFC 3339 format427428 format: date-time429430 - `metadata: map[string]`431432 Arbitrary key-value metadata attached to the credential.433434 - `updated_at: string`435436 A timestamp in RFC 3339 format437438 format: date-time439440 - `vault_id: string`441442 Identifier of the vault this credential belongs to.443444 - `display_name: optional string or null`445446 Human-readable name for the credential.447448## Example449450```bash451curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \452 -H 'Content-Type: application/json' \453 -H 'anthropic-version: 2023-06-01' \454 -H 'anthropic-beta: managed-agents-2026-04-01' \455 -H "X-Api-Key: $ANTHROPIC_API_KEY" \456 -d '{457 "auth": {458 "token": "bearer_exampletoken",459 "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",460 "type": "static_bearer"461 },462 "display_name": "Example credential",463 "metadata": {464 "environment": "production"465 }466 }'467```468469### Response (200)470471```json472{473 "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",474 "archived_at": null,475 "auth": {476 "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",477 "type": "static_bearer"478 },479 "created_at": "2026-03-15T10:00:00Z",480 "metadata": {481 "environment": "production"482 },483 "type": "vault_credential",484 "updated_at": "2026-03-15T10:00:00Z",485 "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",486 "display_name": "Example credential"487}488```489