Create an application credential

POST /v1/applications/{application_id}/credentials · permission applications:write · optional Idempotency-Key

Adds a credential to an application: a platform-generated client secret (type: client_secret) or a registered public key for private_key_jwt (type: public_key).

Client secret. The response carries client_secret once. It cannot be retrieved again; store it immediately. An application holds at most 2 active secrets, so a secret can be rotated without downtime.
Public key. Send the public JWK in jwk. A JWK with private members (d, p, q, dp, dq, qi, oth, k) or larger than 16 KiB is rejected. An application holds at most 5 keys.
Idempotent replay. Repeating the request with the same Idempotency-Key replays the stored response without the secret: the body has secret_redacted: true and no client_secret. Create a new credential if the secret was lost.

Request

Parameter	In	Description
`application_id`	path	Application id (`app_…`).

Body:

Field	Type	Description
`type`	string	Required. `client_secret` or `public_key`.
`expires_at`	string (date-time)	Optional, `client_secret` only; must be in the future.
`jwk`	object	Required for `public_key`; a public JWK, at most 16 KiB.

Response

201 Created with Cache-Control: no-store. The credential object as in the list response; for client_secret it also has client_secret.

{
  "id": "cred_0000000000000000000000001z",
  "type": "client_secret",
  "secret_last4": "abcd",
  "client_secret": "<shown once>",
  "expires_at": null
}

Errors

HTTP	`code`	When
401	`unauthenticated`	The key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the required permission.
404	`not_found`	The application does not exist in this environment.
409	`credential_limit_reached`	The application already has the maximum number of active secrets (2) or keys (5).
409	`conflict`	The same public key is already registered for the application.
422	`validation_failed`	The body is invalid: unknown `type`, missing `jwk`, private JWK members, JWK too large, `expires_at` in the past or sent with `public_key`, or a credential type the application type does not allow (`/type: not_allowed`: `client_secret` only for `web` and `m2m`; `public_key` for `web`, `m2m`, `device` and `management`; `spa` and `native` are public clients and take no credentials).
503	`service_unavailable`	The credential registry is temporarily unavailable; retry after the `Retry-After` delay.

Example

curl -X POST https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg/credentials \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"type":"client_secret"}'