Skip to main content
POST
Create a credential
Create a reusable upstream credential. One credential can back many providers (for example, a single OpenAI key shared across multiple environments or routes). Providers can’t store their own key: create the credential first, then reference it from Create a provider with connection_id.

Choosing the auth method

The model_provider and auth_type together determine which fields are required:
  • API key (auth_type bearer_api_key, x_api_key, azure_api_key, or bedrock_api_key) — pass api_key with the upstream key. When you omit auth_type, it defaults by provider family (for example, x_api_key for anthropic and azure_api_key for azure_openai).
  • Amazon Bedrock (auth_type aws_role or aws_static_credentials) — pass the role or access-key details under credentials. For a role, name Barndoor’s principal from Get Barndoor’s AWS principal in the role’s trust policy, and read the external ID with Get AWS trust info.
  • Google Vertex (auth_type google_adc, google_service_account, or google_service_account_impersonation) — pass the service-account details under credentials.
  • Claude and Codex sign-in passthrough (claude_oauth, codex_oauth) — these store no secret, so they’re configured on a provider without a credential.
The plaintext key (or credentials JSON) is written to Barndoor’s encrypted secret store and is never returned by any subsequent API call. Update or rotate it later with PUT /admin/connections/{id}.

Example

For a guided walkthrough, see Configure the Gateway.

Authorizations

Authorization
string
header
required

An access token from Barndoor's identity provider, sent as Authorization: Bearer <token>. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (bd-...) are not accepted here.

Body

application/json
base_url
string
required
model_provider
string
required

Provider family this credential is for, such as openai, anthropic, bedrock, or vertex.

name
string
required
api_key
string | null

The upstream API key. Stored encrypted and never returned.

auth_type
string | null

How the gateway authenticates upstream. Defaults by provider family.

change_note
string | null

Optional note explaining why this was created. Shown with the record and in the audit log.

credentials
any

Structured credentials for auth types that are not a single key, such as an AWS role or Google credentials. Stored encrypted and never returned.

settings
any

Response

Created

A credential: an upstream secret that providers reference. The secret itself is never returned.

auth_type
string
required

How the gateway authenticates upstream, for example bearer_api_key, x_api_key, azure_api_key, aws_role, or google_adc.

base_url
string
required
created_at
string<date-time>
required
id
string<uuid>
required
model_provider
string
required
name
string
required
org_id
string<uuid>
required
secret_path
string
required

Internal reference to the stored secret. This is not the secret.

settings
any
required
stores_key_material
boolean
required

Whether this credential's auth type stores a secret.

updated_at
string<date-time>
required
created_by_email
string | null
created_by_name
string | null
created_by_user_id
string<uuid> | null
last_change_note
string | null

Note explaining the last change.

last_modified_at
string<date-time> | null

When the last attributed change was made.

last_modified_by_email
string | null
last_modified_by_name
string | null
last_modified_by_user_id
string<uuid> | null
key_last4
string | null

Last four characters of the stored key, when the credential holds one.