from line 4
44description: Register per-user credentials when creating sessions.
55---
66
7## Compatibility
8- Status: Beta
9- [Beta header](https://platform.claude.com/docs/en/api/beta-headers): `managed-agents-2026-04-01`
10
711Vaults and credentials are authentication primitives that let you register credentials for third-party services once and reference them by ID at session creation. This means you don't need to run your own secret store, transmit tokens on every call, or lose track of which end user an agent acted on behalf of.
812
913The vault reference is a per-session parameter, so you can manage your product at the `agent` resource granularity and your users at the `session` resource granularity.
1014
11<Note>
12 Managed Agents API requests require the `managed-agents-2026-04-01` beta header, except memory store endpoints, which use `agent-memory-2026-07-22` instead. The SDK sets the correct beta header automatically. See [Beta headers](https://platform.claude.com/docs/en/api/beta-headers#endpoint-specific-headers).
13</Note>
14
1515## Create a vault
1616
1717<Warning>
from line 168
168168 "access_token": "xoxp-...",
169169 "expires_at": "2099-12-31T23:59:59Z",
170170 "refresh": {
171 "token_endpoint": "https://slack.com/api/oauth.v2.access",
171 "token_endpoint": "https://slack.com/api/oauth.v2.user.access",
172172 "client_id": "1234567890.0987654321",
173173 "scope": "channels:read chat:write",
174174 "refresh_token": "xoxe-1-...",
from line 191
191191 access_token: xoxp-...
192192 expires_at: "2099-12-31T23:59:59Z"
193193 refresh:
194 token_endpoint: https://slack.com/api/oauth.v2.access
194 token_endpoint: https://slack.com/api/oauth.v2.user.access
195195 client_id: "1234567890.0987654321"
196196 scope: channels:read chat:write
197197 refresh_token: xoxe-1-...
from line 212
212212 "access_token": "xoxp-...",
213213 "expires_at": "2099-12-31T23:59:59Z",
214214 "refresh": {
215 "token_endpoint": "https://slack.com/api/oauth.v2.access",
215 "token_endpoint": "https://slack.com/api/oauth.v2.user.access",
216216 "client_id": "1234567890.0987654321",
217217 "scope": "channels:read chat:write",
218218 "refresh_token": "xoxe-1-...",
from line 231
231231 access_token: "xoxp-...",
232232 expires_at: "2099-12-31T23:59:59Z",
233233 refresh: {
234 token_endpoint: "https://slack.com/api/oauth.v2.access",
234 token_endpoint: "https://slack.com/api/oauth.v2.user.access",
235235 client_id: "1234567890.0987654321",
236236 scope: "channels:read chat:write",
237237 refresh_token: "xoxe-1-...",
from line 256
256256 ExpiresAt = DateTimeOffset.Parse("2099-12-31T23:59:59Z"),
257257 Refresh = new()
258258 {
259 TokenEndpoint = "https://slack.com/api/oauth.v2.access",
259 TokenEndpoint = "https://slack.com/api/oauth.v2.user.access",
260260 ClientID = "1234567890.0987654321",
261261 Scope = "channels:read chat:write",
262262 RefreshToken = "xoxe-1-...",
from line 280
280280 AccessToken: "xoxp-...",
281281 ExpiresAt: anthropic.Time(time.Date(2099, time.December, 31, 23, 59, 59, 0, time.UTC)),
282282 Refresh: anthropic.BetaManagedAgentsMCPOAuthRefreshParams{
283 TokenEndpoint: "https://slack.com/api/oauth.v2.access",
283 TokenEndpoint: "https://slack.com/api/oauth.v2.user.access",
284284 ClientID: "1234567890.0987654321",
285285 Scope: anthropic.String("channels:read chat:write"),
286286 RefreshToken: "xoxe-1-...",
from line 309
309309 .accessToken("xoxp-...")
310310 .expiresAt(OffsetDateTime.parse("2099-12-31T23:59:59Z"))
311311 .refresh(BetaManagedAgentsMcpOAuthRefreshParams.builder()
312 .tokenEndpoint("https://slack.com/api/oauth.v2.access")
312 .tokenEndpoint("https://slack.com/api/oauth.v2.user.access")
313313 .clientId("1234567890.0987654321")
314314 .scope("channels:read chat:write")
315315 .refreshToken("xoxe-1-...")
from line 329
329329 accessToken: 'xoxp-...',
330330 expiresAt: new DateTimeImmutable('2099-12-31T23:59:59Z'),
331331 refresh: ManagedAgentsMCPOAuthRefreshParams::with(
332 tokenEndpoint: 'https://slack.com/api/oauth.v2.access',
332 tokenEndpoint: 'https://slack.com/api/oauth.v2.user.access',
333333 clientID: '1234567890.0987654321',
334334 scope: 'channels:read chat:write',
335335 refreshToken: 'xoxe-1-...',
from line 352
352352 access_token: "xoxp-...",
353353 expires_at: "2099-12-31T23:59:59Z",
354354 refresh: {
355 token_endpoint: "https://slack.com/api/oauth.v2.access",
355 token_endpoint: "https://slack.com/api/oauth.v2.user.access",
356356 client_id: "1234567890.0987654321",
357357 scope: "channels:read chat:write",
358358 refresh_token: "xoxe-1-...",
from line 365
365365 )
366366 ```
367367 </CodeGroup>
368
369 Set `refresh.token_endpoint` to the token endpoint of the OAuth flow that issued the refresh token, because Anthropic sends every refresh request to that URL and the field can't be changed after the credential is created.
368370 </Tab>
369371
370372 <Tab title="MCP static bearer">