create_credential
Save a new reusable credential, sealed with the project's encryption key at write time. Neither this call nor any later read ever returns the secret back — reference it from a target by id (see create_endpoint/update_endpoint's target.credentialVaultEntryId) instead of copying the secret around. auth.type selects which fields apply: bearer→token, basic→username+password, apiKeyHeader→headerName+key, apiKeyQuery→paramName+key, publicPrivateKey→secret+key, oauthClientCredentials→tokenUrl+clientId+clientSecret (+ optional scope, audience, clientAuth "basic"|"post"; the access token is fetched at delivery, and clientSecret is never returned. The client secret is only ever sent to tokenUrl, and the access token only to the bound destinationHost; tokenUrl is permanent like destinationHost — it must pass the project's outbound host allowlist at create, and an update that changes it is refused), signingSecret→secret (the secret a sender such as GitHub or Stripe signs the webhooks it sends you with; attach it to an endpoint as senderSignature.credentialId). destinationHost is required and permanent: the credential is only ever sent to that host, over https, and no later call can re-aim it. A signingSecret credential is never sent anywhere, so it takes no destinationHost.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| auth | Yes | The credential's auth shape. | |
| name | Yes | Human-readable label, up to 120 characters. | |
| destinationHost | No | The only host this credential may be sent to, e.g. "api.stripe.com", or a single-label wildcard, e.g. "*.stripe.com" (matches api.stripe.com, not stripe.com and not a.b.stripe.com). Host only — no scheme, port or path. Internationalised hosts must be given in punycode ("xn--…"). Permanent: attaching this credential to a target on any other host is refused, and it cannot be changed later — a different destination means a new credential, which means entering the secret again. |