Repository Public
1Credentials are server-managed secrets that let your agents reach third-party2services without the secret ever entering the agent's environment. You store a3credential once, reference it by ID, and the egress proxy resolves and injects4it at request time.56Secret values are write-only. Once stored, they are never returned by any7endpoint, so a compromised agent cannot read back the tokens it is using.89The primary place you use a credential is the network allowlist on10[`environment.network`](https://ai.google.dev/gemini-api/docs/agent-environment). Store the secret11first:1213### Python1415 from google import genai1617 client = genai.Client()1819 credential = client.credentials.create(20 id="github-production",21 type="bearer_token",22 token="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",23 )2425 print(f"Credential ID: {credential.id}, Status: {credential.status}")2627### JavaScript2829 import { GoogleGenAI } from "@google/genai";3031 const client = new GoogleGenAI({});3233 const credential = await client.credentials.create({34 id: "github-production",35 type: "bearer_token",36 token: "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",37 });3839 console.log(`Credential ID: ${credential.id}, Status: ${credential.status}`);4041### REST4243 curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \44 -H "Content-Type: application/json" \45 -H "x-goog-api-key: $GEMINI_API_KEY" \46 -d '{47 "id": "github-production",48 "type": "bearer_token",49 "token": "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"50 }'5152Then attach it to the domain it authenticates:5354### Python5556 interaction = client.interactions.create(57 agent="antigravity-preview-09-2026",58 input="Triage the open issues in my-org/my-repo.",59 environment={60 "type": "remote",61 "network": {62 "allowlist": [63 {"domain": "api.github.com", "credential": "github-production"},64 {"domain": "*"},65 ]66 },67 },68 )6970### JavaScript7172 const interaction = await client.interactions.create({73 agent: "antigravity-preview-09-2026",74 input: "Triage the open issues in my-org/my-repo.",75 environment: {76 type: "remote",77 network: {78 allowlist: [79 { domain: "api.github.com", credential: "github-production" },80 { domain: "*" },81 ],82 },83 },84 });8586### REST8788 curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \89 -H "Content-Type: application/json" \90 -H "x-goog-api-key: $GEMINI_API_KEY" \91 -d '{92 "agent": "antigravity-preview-09-2026",93 "input": "Triage the open issues in my-org/my-repo.",94 "environment": {95 "type": "remote",96 "network": {97 "allowlist": [98 { "domain": "api.github.com", "credential": "github-production" },99 { "domain": "*" }100 ]101 }102 }103 }'104105The agent now makes authenticated requests to `api.github.com`, and the token106never exists inside the sandbox.107108## Credential types109110Every credential has a `type` that determines which fields it accepts and how111the proxy applies it.112113| Type | Use case | Behavior |114|---|---|---|115| `bearer_token` | Personal access tokens, bot tokens, static API keys | The proxy injects the token as a request header. No refresh logic. |116| `oauth2` | OAuth apps and user-delegated flows | The proxy exchanges the refresh token for access tokens and refreshes them as they expire. |117| `environment_variable` | Client SDKs that read secrets from the process environment | The agent's environment receives a placeholder. The proxy substitutes the real secret on outbound requests. |118119## Use credentials in the network allowlist120121Add `credential` to an allowlist rule and the proxy authenticates every122outbound request to that domain. This is the recommended way to give an agent123access to a private API, a private repository, or a private bucket.124125You can mix authenticated and unauthenticated rules in the same allowlist:126127### Python128129 interaction = client.interactions.create(130 agent="antigravity-preview-09-2026",131 input="Sync the open Jira issues into the tracking sheet in my repo.",132 environment={133 "type": "remote",134 "sources": [135 {136 "type": "repository",137 "source": "https://github.com/your-org/backend",138 "target": "/backend-app",139 }140 ],141 "network": {142 "allowlist": [143 {"domain": "github.com", "credential": "github-production"},144 {"domain": "api.atlassian.com", "credential": "jira-oauth"},145 {"domain": "*.googleapis.com"},146 ]147 },148 },149 )150151### JavaScript152153 const interaction = await client.interactions.create({154 agent: "antigravity-preview-09-2026",155 input: "Sync the open Jira issues into the tracking sheet in my repo.",156 environment: {157 type: "remote",158 sources: [159 {160 type: "repository",161 source: "https://github.com/your-org/backend",162 target: "/backend-app",163 },164 ],165 network: {166 allowlist: [167 { domain: "github.com", credential: "github-production" },168 { domain: "api.atlassian.com", credential: "jira-oauth" },169 { domain: "*.googleapis.com" },170 ],171 },172 },173 });174175### REST176177 curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \178 -H "Content-Type: application/json" \179 -H "x-goog-api-key: $GEMINI_API_KEY" \180 -d '{181 "agent": "antigravity-preview-09-2026",182 "input": "Sync the open Jira issues into the tracking sheet in my repo.",183 "environment": {184 "type": "remote",185 "sources": [186 {187 "type": "repository",188 "source": "https://github.com/your-org/backend",189 "target": "/backend-app"190 }191 ],192 "network": {193 "allowlist": [194 { "domain": "github.com", "credential": "github-production" },195 { "domain": "api.atlassian.com", "credential": "jira-oauth" },196 { "domain": "*.googleapis.com" }197 ]198 }199 }200 }'201202Because the proxy resolves the credential per request, an `oauth2` credential203refreshes its access token transparently. A long-running interaction does not204break when the access token expires.205206### Combining `credential` and `transform`207208Allowlist rules also accept an inline209[`transform`](https://ai.google.dev/gemini-api/docs/agent-environment#private-sources) object that210sets headers directly on the rule. Both mechanisms are applied by the egress211proxy on the wire, so in both cases the header value never exists inside the212sandbox. Both fields can appear on the same rule.213214| Rule configuration | Behavior |215|---|---|216| `credential` only | The proxy resolves the credential and injects its header on every request to the domain. |217| `transform` only | Static header injection. The headers you write are sent as-is. |218| Both | The credential is applied first, then `transform` merges on top. An explicit `transform` header wins if both set the same key. |219| Neither | The domain is allowed and no headers are injected. |220221A credential is worth using when you want to store a secret once and reference222it from every environment, agent, and trigger in your project, and when you want223access token refresh and rotation handled for you. An inline `transform` fits224when the value belongs to a single call, for example a token you generate225yourself right before creating the interaction.226227Combining the two is common. The credential carries the authentication header228and `transform` adds whatever else the upstream service expects on the same229request:230231 {232 "domain": "api.atlassian.com",233 "credential": "jira-oauth",234 "transform": {235 "X-Atlassian-Workspace": "my-workspace-id"236 }237 }238239To move a secret out of an inline `transform` and into a credential, store it240with `POST /credentials`, replace the auth header in `transform` with241`"credential": "<id>"`, and leave the rest of the `transform` object alone.242243## Use credentials with MCP servers244245Remote MCP servers take the same `credential` field. Set it on an `mcp_server`246tool and the proxy injects the auth header into every request to that server:247248### Python249250 interaction = client.interactions.create(251 agent="antigravity-preview-09-2026",252 input="Create a new issue in my-org/my-repo",253 environment="remote",254 tools=[{255 "type": "mcp_server",256 "name": "github",257 "url": "https://api.githubcopilot.com/mcp",258 "credential": "github-production",259 }],260 )261262### JavaScript263264 const interaction = await client.interactions.create({265 agent: "antigravity-preview-09-2026",266 input: "Create a new issue in my-org/my-repo",267 environment: "remote",268 tools: [{269 type: "mcp_server",270 name: "github",271 url: "https://api.githubcopilot.com/mcp",272 credential: "github-production",273 }],274 });275276### REST277278 curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \279 -H "Content-Type: application/json" \280 -H "x-goog-api-key: $GEMINI_API_KEY" \281 -d '{282 "agent": "antigravity-preview-09-2026",283 "input": "Create a new issue in my-org/my-repo",284 "environment": "remote",285 "tools": [286 {287 "type": "mcp_server",288 "name": "github",289 "url": "https://api.githubcopilot.com/mcp",290 "credential": "github-production"291 }292 ]293 }'294295`credential` and `headers` follow the same precedence rule as the allowlist.296The credential is applied first and `headers` merges on top, so an explicit297header wins if both set the same key:298299 {300 "type": "mcp_server",301 "name": "jira",302 "url": "https://jira.atlassian.com/mcp",303 "credential": "jira-oauth",304 "headers": {305 "X-Atlassian-Workspace": "my-workspace-id"306 }307 }308309To move a secret out of inline `headers` and into a credential, store it with310`POST /credentials` and replace the auth entry in `headers` with `credential`.311Keep the other headers where they are.312313## Use credentials as environment variables314315Some client libraries read secrets from the process environment rather than316accepting them as request headers. Socket-mode and long-polling clients are the317common case.318319Bind an `environment_variable` credential to a variable name under320`environment.env`:321322### Python323324 interaction = client.interactions.create(325 agent="antigravity-preview-09-2026",326 input="Run the sync script and check notifications.",327 environment={328 "type": "remote",329 "env": {330 "NODE_ENV": "production",331 "SLACK_BOT_TOKEN": {"credential": "slack-bot-token"},332 },333 },334 )335336### JavaScript337338 const interaction = await client.interactions.create({339 agent: "antigravity-preview-09-2026",340 input: "Run the sync script and check notifications.",341 environment: {342 type: "remote",343 env: {344 NODE_ENV: "production",345 SLACK_BOT_TOKEN: { credential: "slack-bot-token" },346 },347 },348 });349350### REST351352 curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \353 -H "Content-Type: application/json" \354 -H "x-goog-api-key: $GEMINI_API_KEY" \355 -d '{356 "agent": "antigravity-preview-09-2026",357 "input": "Run the sync script and check notifications.",358 "environment": {359 "type": "remote",360 "env": {361 "NODE_ENV": "production",362 "SLACK_BOT_TOKEN": { "credential": "slack-bot-token" }363 }364 }365 }'366367`env` accepts literal strings and credential references side by side. A literal368string is injected into the container as a normal plaintext variable.369370A credential reference is not. The variable receives the placeholder371`__GEMINI_CRED_<credential-id>__`, and the proxy swaps in the real secret only372for outbound requests going to a domain in the credential's `trusted_domains`. A373request to any other domain is rejected, so the secret never leaves the374perimeter and the placeholder is not sent in its place.375376> [!CAUTION]377> **Caution:** Literal values are injected as plain text and are readable by anything running in the sandbox, including the agent itself. Use them for configuration like `NODE_ENV`, not for secrets. A secret belongs in a credential, which is the only form that gets a placeholder and on-the-wire substitution.378379Set `trusted_domains` on every `environment_variable` credential. It is the380control that scopes where the secret can be used.381382## Create a credential383384Every create request needs a `type`, plus whichever fields that type requires.385386When calling REST directly, all field names use snake_case. Sending a camelCase387field returns a `400`.388389### Bearer token390391A bearer token credential needs only `token`:392393### Python394395 credential = client.credentials.create(396 id="github-production",397 type="bearer_token",398 token="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",399 )400401### JavaScript402403 const credential = await client.credentials.create({404 id: "github-production",405 type: "bearer_token",406 token: "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",407 });408409### REST410411 curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \412 -H "Content-Type: application/json" \413 -H "x-goog-api-key: $GEMINI_API_KEY" \414 -d '{415 "id": "github-production",416 "type": "bearer_token",417 "token": "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"418 }'419420The response returns metadata only, never the token:421422 {423 "id": "github-production",424 "type": "bearer_token",425 "status": "active",426 "create_time": "2026-07-15T10:00:00.000000000Z",427 "update_time": "2026-07-15T10:00:00.000000000Z"428 }429430By default the proxy sends `Authorization: Bearer <token>`. Override431`header_name` and `prefix` to target a service that expects something else:432433### Python434435 credential = client.credentials.create(436 id="my-api-key",437 type="bearer_token",438 token="key_xxxxxxxxxxxx",439 header_name="x-goog-api-key",440 prefix="",441 )442443### JavaScript444445 const credential = await client.credentials.create({446 id: "my-api-key",447 type: "bearer_token",448 token: "key_xxxxxxxxxxxx",449 header_name: "x-goog-api-key",450 prefix: "",451 });452453### REST454455 curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \456 -H "Content-Type: application/json" \457 -H "x-goog-api-key: $GEMINI_API_KEY" \458 -d '{459 "id": "my-api-key",460 "type": "bearer_token",461 "token": "key_xxxxxxxxxxxx",462 "header_name": "x-goog-api-key",463 "prefix": ""464 }'465466This configuration produces the header `x-goog-api-key: key_xxxxxxxxxxxx`.467468The following table shows how `header_name` and `prefix` combine:469470| Configuration | Injected header |471|---|---|472| `{"token": "ghp_xxx"}` | `Authorization: Bearer ghp_xxx` |473| `{"token": "sk_live_xxx"}` | `Authorization: Bearer sk_live_xxx` |474| `{"token": "key_xxx", "header_name": "x-goog-api-key", "prefix": ""}` | `x-goog-api-key: key_xxx` |475| `{"token": "mytoken", "header_name": "X-API-Token", "prefix": ""}` | `X-API-Token: mytoken` |476477### OAuth2478479An OAuth2 credential requires `client_id`, `client_secret`, `refresh_token`,480and `token_url`. The `scopes` field is optional:481482### Python483484 credential = client.credentials.create(485 id="jira-oauth",486 type="oauth2",487 client_id="my-client-id",488 client_secret="my-client-secret",489 token_url="https://auth.atlassian.com/oauth/token",490 refresh_token="rt_xxxxxxxxxxxxxxxxxxxx",491 scopes=["read:jira-work", "write:jira-work"],492 )493494### JavaScript495496 const credential = await client.credentials.create({497 id: "jira-oauth",498 type: "oauth2",499 client_id: "my-client-id",500 client_secret: "my-client-secret",501 token_url: "https://auth.atlassian.com/oauth/token",502 refresh_token: "rt_xxxxxxxxxxxxxxxxxxxx",503 scopes: ["read:jira-work", "write:jira-work"],504 });505506### REST507508 curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \509 -H "Content-Type: application/json" \510 -H "x-goog-api-key: $GEMINI_API_KEY" \511 -d '{512 "id": "jira-oauth",513 "type": "oauth2",514 "client_id": "my-client-id",515 "client_secret": "my-client-secret",516 "token_url": "https://auth.atlassian.com/oauth/token",517 "refresh_token": "rt_xxxxxxxxxxxxxxxxxxxx",518 "scopes": ["read:jira-work", "write:jira-work"]519 }'520521Creating an OAuth2 credential performs a live token exchange against522`token_url` to confirm the configuration works. The credential is stored only523if the provider returns a successful token response containing an524`access_token`. Both JSON and form-urlencoded responses are accepted.525526This means you need a valid, unexpired refresh token at creation time. If the527provider rejects the exchange, the error is returned to you:528529 {530 "error": {531 "message": "OAuth token validation failed with HTTP 403: {\"error\":\"unauthorized_client\",\"error_description\":\"refresh_token is invalid\"}",532 "code": "invalid_request"533 }534 }535536Once stored, the proxy refreshes access tokens as they expire. If the provider537rotates refresh tokens and returns a new one during a refresh, the new token538replaces the stored one automatically.539540### Environment variable541542An `environment_variable` credential requires `value` and `injection_location`:543544### Python545546 credential = client.credentials.create(547 id="slack-bot-token",548 type="environment_variable",549 value="xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx",550 trusted_domains=["*.slack.com", "slack.com"],551 injection_location="header",552 )553554### JavaScript555556 const credential = await client.credentials.create({557 id: "slack-bot-token",558 type: "environment_variable",559 value: "xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx",560 trusted_domains: ["*.slack.com", "slack.com"],561 injection_location: "header",562 });563564### REST565566 curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \567 -H "Content-Type: application/json" \568 -H "x-goog-api-key: $GEMINI_API_KEY" \569 -d '{570 "id": "slack-bot-token",571 "type": "environment_variable",572 "value": "xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx",573 "trusted_domains": ["*.slack.com", "slack.com"],574 "injection_location": "header"575 }'576577The `injection_location` field tells the proxy where in the outbound request to578substitute the secret. It accepts `header`, `query`, or `body`, either as a579single string or as an array when a service needs more than one:580581 "injection_location": ["header", "query"]582583Substitution happens only in the locations you list. A request that carries the584placeholder anywhere else is rejected rather than sent on.585586To bind the credential to a variable name, see587[Use credentials as environment variables](https://ai.google.dev/gemini-api/docs/agent-credentials#environment-variables).588589### Generated IDs590591The `id` field is optional. Omit it and the service generates a UUID:592593 {594 "id": "9e545973-4330-49bb-9a44-930cea9fbe3c",595 "type": "bearer_token",596 "status": "active",597 "create_time": "2026-07-15T10:00:00.000000000Z",598 "update_time": "2026-07-15T10:00:00.000000000Z"599 }600601Supply your own ID when you want a stable, readable reference to use across602interactions. Since the ID appears in the resource path, prefer lowercase603alphanumerics with hyphens or underscores.604605## List credentials606607List the credentials belonging to your project. Use pagination parameters to608control the response batch size.609610### Python611612 response = client.credentials.list(page_size=10)613 for credential in response.credentials:614 print(f"Credential ID: {credential.id}, Type: {credential.type}")615616### JavaScript617618 const response = await client.credentials.list({ page_size: 10 });619 for (const credential of response.credentials) {620 console.log(`Credential ID: ${credential.id}, Type: ${credential.type}`);621 }622623### REST624625 curl -X GET "https://generativelanguage.googleapis.com/v1beta/credentials?page_size=10" \626 -H "x-goog-api-key: $GEMINI_API_KEY"627628The response contains metadata only:629630 {631 "credentials": [632 {633 "id": "github-production",634 "type": "bearer_token",635 "status": "active",636 "create_time": "2026-07-15T10:00:00.000000000Z",637 "update_time": "2026-07-15T10:00:00.000000000Z"638 },639 {640 "id": "jira-oauth",641 "type": "oauth2",642 "status": "active",643 "create_time": "2026-07-15T10:05:00.000000000Z",644 "update_time": "2026-07-15T10:05:00.000000000Z"645 }646 ],647 "next_page_token": "Cj...5aE="648 }649650Pass `next_page_token` back as `page_token` to fetch the next page. The field651is omitted when there are no further results.652653| Parameter | Type | Description |654|---|---|---|655| `page_size` | integer | Maximum number of credentials per page. |656| `page_token` | string | Token from the `next_page_token` of a previous response. |657658## Get a credential659660Retrieve metadata for a specific credential by its ID.661662### Python663664 credential = client.credentials.get(id="github-production")665 print(f"Credential ID: {credential.id}, Status: {credential.status}")666667### JavaScript668669 const credential = await client.credentials.get("github-production");670 console.log(`Credential ID: ${credential.id}, Status: ${credential.status}`);671672### REST673674 curl -X GET "https://generativelanguage.googleapis.com/v1beta/credentials/github-production" \675 -H "x-goog-api-key: $GEMINI_API_KEY"676677The response looks similar to the following:678679 {680 "id": "github-production",681 "type": "bearer_token",682 "status": "active",683 "create_time": "2026-07-15T10:00:00.000000000Z",684 "update_time": "2026-08-01T14:30:00.000000000Z"685 }686687Requesting a credential that does not exist returns `404`:688689 {690 "error": {691 "message": "Result not found.; GetCredential call failed",692 "code": "not_found"693 }694 }695696## Rotate a credential697698Replace a secret without touching any allowlist rule, tool definition, or699environment variable that references it. Rotation takes effect on the next700proxy resolution.701702The request must include `type`, plus the fields you want to change. Fields you703omit keep their current values.704705Rotate a bearer token:706707### Python708709 credential = client.credentials.update(710 id="github-production",711 type="bearer_token",712 token="ghp_new_xxxxxxxxxxxxxxxxxxxx",713 )714715### JavaScript716717 const credential = await client.credentials.update("github-production", {718 type: "bearer_token",719 token: "ghp_new_xxxxxxxxxxxxxxxxxxxx",720 });721722### REST723724 curl -X PATCH "https://generativelanguage.googleapis.com/v1beta/credentials/github-production" \725 -H "Content-Type: application/json" \726 -H "x-goog-api-key: $GEMINI_API_KEY" \727 -d '{728 "type": "bearer_token",729 "token": "ghp_new_xxxxxxxxxxxxxxxxxxxx"730 }'731732Rotate an OAuth2 refresh token:733734### Python735736 credential = client.credentials.update(737 id="jira-oauth",738 type="oauth2",739 refresh_token="rt_new_xxxxxxxxxxxxxxxxxxxx",740 )741742### JavaScript743744 const credential = await client.credentials.update("jira-oauth", {745 type: "oauth2",746 refresh_token: "rt_new_xxxxxxxxxxxxxxxxxxxx",747 });748749### REST750751 curl -X PATCH "https://generativelanguage.googleapis.com/v1beta/credentials/jira-oauth" \752 -H "Content-Type: application/json" \753 -H "x-goog-api-key: $GEMINI_API_KEY" \754 -d '{755 "type": "oauth2",756 "refresh_token": "rt_new_xxxxxxxxxxxxxxxxxxxx"757 }'758759The response reflects the new `update_time`:760761 {762 "id": "jira-oauth",763 "type": "oauth2",764 "status": "active",765 "create_time": "2026-07-15T10:05:00.000000000Z",766 "update_time": "2026-08-01T14:30:00.000000000Z"767 }768769A credential's `type` is fixed at creation. To change it, delete the credential770and create a new one.771772## Delete a credential773774Delete a credential and its stored secret when it is no longer needed.775776### Python777778 client.credentials.delete(id="github-production")779780### JavaScript781782 await client.credentials.delete("github-production");783784### REST785786 curl -X DELETE "https://generativelanguage.googleapis.com/v1beta/credentials/github-production" \787 -H "x-goog-api-key: $GEMINI_API_KEY"788789A successful delete returns an empty object:790791 {}792793Any allowlist rule, tool, or environment variable still referencing the ID will794fail to resolve, so update those first.795796## Field reference797798Fields common to every credential:799800| Field | Type | Required | Description |801|---|---|---|---|802| `id` | string | No | Unique identifier. Generated as a UUID when omitted. |803| `type` | string | Yes | One of `bearer_token`, `oauth2`, `environment_variable`. |804| `status` | string | Read-only | Current status of the credential. |805| `create_time` | string | Read-only | RFC 3339 creation timestamp. |806| `update_time` | string | Read-only | RFC 3339 timestamp of the last update. |807808Fields for `bearer_token`:809810| Field | Type | Required | Description |811|---|---|---|---|812| `token` | string | Yes | Write-only. The token value. |813| `header_name` | string | No | Header to inject. Defaults to `Authorization`. |814| `prefix` | string | No | Value prefix. Defaults to `Bearer`. Set to `""` for none. |815816Fields for `oauth2`:817818| Field | Type | Required | Description |819|---|---|---|---|820| `client_id` | string | Yes | OAuth2 client ID. |821| `client_secret` | string | Yes | Write-only. OAuth2 client secret. |822| `refresh_token` | string | Yes | Write-only. Refresh token used to obtain access tokens. |823| `token_url` | string | Yes | Provider token endpoint. |824| `scopes` | array | No | OAuth scopes to request. |825826Fields for `environment_variable`:827828| Field | Type | Required | Description |829|---|---|---|---|830| `value` | string | Yes | Write-only. The secret value. |831| `injection_location` | string or array | Yes | Where to substitute the secret. One or more of `header`, `query`, `body`. |832| `trusted_domains` | array | No | Domain patterns authorized for substitution. |833834## Errors835836Errors return a JSON object with a `message` and a `code`:837838 {839 "error": {840 "message": "Credential 'github-production' already exists.; CreateCredential call failed",841 "code": "aborted"842 }843 }844845| HTTP status | `code` | Cause |846|---|---|---|847| 400 | `invalid_request` | Missing required field, unknown field, unsupported `type`, or a failed OAuth2 validation. |848| 404 | `not_found` | No credential with that ID. |849| 409 | `aborted` | A credential with that ID already exists. |850851Unknown fields are rejected rather than ignored, and the error names the field:852853 {854 "error": {855 "message": "Unknown parameter 'headerName'. Did you mean 'header_name'?",856 "code": "invalid_request"857 }858 }859860## What's next861862- [Environments](https://ai.google.dev/gemini-api/docs/agent-environment): Learn how agents run code and persist files.863- [Agents Overview](https://ai.google.dev/gemini-api/docs/agents): Learn about the core concepts of managed agents.864- [Building Custom Agents](https://ai.google.dev/gemini-api/docs/custom-agents): Define your own agents using `AGENTS.md` and `SKILL.md`.