Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Developer Platform 20 Oct 2026
One change · api

Create a Credential changedapi/beta/vaults/credentials/create

Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here
Lines+22added
Lines−16removed
From line 1 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits20to this page, all time

# Create a Credential # Create Credential

The whole hunk

from line 1, old and new numbered
/
lines
from line 1
11---
2title: Create Credential
2title: Create a Credential
33url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/create
44---
55 
6# Create Credential
6# Create a Credential
77 
88**POST** `/v1/vaults/{vault_id}/credentials`
99 
10Create Credential
10Create a Credential
1111 
1212## Path parameters
1313 
from line 151
151151 
152152 - `access_token: string`
153153 
154 OAuth access token.
154 The OAuth access token to send to the MCP server.
155155 
156156 minLength: 1, maxLength: 8192
157157 
from line 163
163163 
164164 - `expires_at: optional string or null`
165165 
166 A timestamp in RFC 3339 format
166 When `access_token` expires, in RFC 3339.
167167 
168 Must be in the future.
169 
168170 format: date-time
169171 
170172 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
from line 175
173175 
174176 - `client_id: string`
175177 
176 OAuth client ID.
178 The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.
177179 
178180 minLength: 1, maxLength: 1024
179181 
180182 - `refresh_token: string`
181183 
182 OAuth refresh token.
184 The OAuth refresh token that the API uses to get a new access token when the current one expires.
183185 
184186 minLength: 1, maxLength: 8192
185187 
from line 207
205207 
206208 - `client_secret: string`
207209 
208 OAuth client secret.
210 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
209211 
210212 minLength: 1, maxLength: 512
211213 
from line 219
217219 
218220 - `client_secret: string`
219221 
220 OAuth client secret.
222 The OAuth client secret, sent to `token_endpoint` in the POST body.
221223 
222224 minLength: 1, maxLength: 512
223225 
from line 243
241243 
242244 - `token: string`
243245 
244 Static bearer token value.
246 The static bearer token to send to the MCP server, such as an API key or personal access token.
245247 
246248 minLength: 1, maxLength: 8192
247249 
from line 277
275277 
276278 - `allowed_hosts: array of string`
277279 
278 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
280 The destination hosts of the outbound requests that the credential's secret is substituted into.
279281 
282 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
283 
280284 - `secret_name: string`
281285 
282286 Name of the environment variable. Immutable after create.
from line 289
285289 
286290 - `secret_value: string`
287291 
288 Secret value. Write-only; never returned in responses.
292 The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses.
289293 
290294 minLength: 1, maxLength: 4096
291295 
from line 325
321325 
322326 - `id: string`
323327 
324 Unique identifier for the credential.
328 The unique ID of the credential (`vcrd_...`).
325329 
326330 - `archived_at: string or null`
327331 
from line 349
345349 
346350 - `expires_at: optional string or null`
347351 
348 A timestamp in RFC 3339 format
352 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
349353 
350354 format: date-time
351355 
from line 359
355359 
356360 - `client_id: string`
357361 
358 OAuth client ID.
362 The OAuth client ID used when refreshing the access token.
359363 
360364 - `token_endpoint: string`
361365 
from line 439
435439 
436440 - `allowed_hosts: array of string`
437441 
438 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
442 The destination hosts of the outbound requests that the credential's secret is substituted into.
443 
444 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
439445 
440446 - `secret_name: string`
441447 
Feedback