Create a credential

Stores a new credential for authenticating with an external source. The credential is created immediately and can be used on task runs.

POST /credentials

cURL

username_password

curl --request POST \
  --url https://api.deck.co/v2/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "source_id": "src_AbC123xYz456",
  "auth_method": "username_password",
  "auth_credentials": {
    "username": "[e-mail]",
    "password": "..."
  },
  "external_id": "cust_42"
}
'

201

{
  "id": "cred_AbC123xYz456",
  "object": "<string>",
  "status": "<string>",
  "external_id": "<string>",
  "source_id": "<string>",
  "auth_method": "<string>",
  "auth_credentials": {
    "username": "<string>",
    "email": "<string>",
    "source_fields": {},
    "tokenized": [
      "<string>"
    ]
  },
  "persistence": {
    "enabled": true
  },
  "created_at": "2026-08-24T12:00:00Z",
  "updated_at": "2026-08-24T12:00:00Z",
  "request_id": "<string>"
}

Authorizations

Authorization · string · header · required

Secret key (sk_live_...)

Headers

Idempotency-Key · string

Optional key that makes the request idempotent. Retrying with the same key returns the original response instead of repeating the operation; keys expire after 24 hours. Any string up to 256 characters. See Idempotency.

Maximum string length: 256

Example:

"550e8400-e29b-41d4-a716-446655440000"

Body

application/jsontext/jsonapplication/*+json

Request body for creating a new credential.

source_id · string · required

The source to authenticate against. Prefixed with src_.

auth_method · null | string

Authentication method for the source. One of username_password, source_fields, google_sso, apple_sso, or none.

auth_credentials · object

Credentials payload. Structure depends on auth_method. For username_password, pass username and password. For google_sso and apple_sso, pass email and password for the end user's Google or Apple Account. For source_fields, pass at least one entry in source_fields. Any auth_method except none may also include source_fields alongside its credentials (for example, username and password plus source_fields in the same payload), and tokenized to vault selected source-field values.

Show child attributes

external_id · null | string

An identifier from your system to associate with this credential. Max 255 characters. See the external IDs guide for multi-tenant patterns.

persistence · object

Persistence settings. Omit to leave persistence off.

Show child attributes

Response

201

text/plain

Created

id · string · required

Unique identifier for the credential, prefixed with cred_.

Pattern: ^cred_

Example:

"cred_AbC123xYz456"

object · string · required

Always credential.

status · string · required

Credential status: unverified, verified, invalid, or deleted.

external_id · null | string · required

External identifier from your system, if set.

source_id · string · required

The source this credential authenticates against. Prefixed with src_.

auth_method · string · required

Authentication method: username_password, source_fields, google_sso, apple_sso, or none.

auth_credentials · null | object · required

Summary of stored credentials. Sensitive values are not returned.

Show child attributes

persistence · object · required

Persistence settings for this credential.

Show child attributes

created_at · string<date-time> · required

ISO 8601 timestamp of when the resource was created.

Example:

"2026-08-24T12:00:00Z"

updated_at · string<date-time> · required

ISO 8601 timestamp of when the resource was last updated.

Example:

"2026-08-24T12:00:00Z"

request_id · string · required

Unique identifier for the API request. Include this when contacting support.