Create a tool credential
Saves a secret for tools to use: bearer, basic, a named header or a query parameter. The secret is accepted once and never returned.
Scopes: tool:write
Authorizations
An API key from Settings → API keys, sent as Authorization: Bearer kb_live_…. A workspace key starts kb_; a personal key starts kbp_ and acts as its owner.
Headers
A unique key (a UUID works) for this request. Retrying with the same key returns the first answer instead of running twice.
255The API version to answer as, a date (YYYY-MM-DD). Leave it out for the current version (2026-11-07). An unknown version is refused with 400 unsupported_api_version.
2026-11-07 "2026-11-07"
Body
A name you'll recognise, e.g. "Calendly key".
1 - 120How the secret is sent: bearer (Authorization: Bearer …), header (a custom header, header_name), basic (user:password, Basic auth) or query (a query parameter, query_name).
bearer, header, basic, query The key, token or user:password. Stored encrypted and never returned; only a hint is.
1 - 4096The header to send it in. Required when auth_type is header.
100The query parameter to send it in. Required when auth_type is query.
100Response
Successful Response
A saved secret tools sign in with. The secret itself is never returned.
The credential's id. Reference it from a tool as auth.credential_id.
Its name.
How it signs in. oauth2 and mcp_oauth come from a sign-in flow, not this API.
bearer, header, basic, query, oauth2, mcp_oauth Whether tools can use it.
active, needs_reauth, revoked, error The header it is sent in (header only).
The query parameter it is sent in (query only).
The secret's last few characters, to tell keys apart.
The OAuth provider (OAuth credentials only).
The OAuth issuer (OAuth credentials only).
Granted OAuth scopes.
When the access token expires (ISO 8601).
The last error code, if any.
When a tool last used it (ISO 8601).
When the secret was last replaced (ISO 8601).
When it was revoked (ISO 8601).
When it was created (ISO 8601).
When it last changed (ISO 8601).