创建凭据

向保险库存入一条第三方凭据（例如 MCP 服务的 OAuth 令牌）。

POST /anthropic/v1/vaults/{vault_id}/credentials◐ 部分支持

请求参数

vault_idstring必填
path: 保险库 ID（路径或查询参数）。
authobject必填
Authentication details for creating a credential.
▸ 展开子字段（10）
- access_tokenstring必填
  OAuth access token.
- mcp_server_urlstring必填
  URL of the MCP server this credential authenticates against.
- typestring必填
  取值 environment_variable
- expires_atstring可选
  A timestamp in RFC 3339 format
- refreshobject可选
  OAuth refresh token parameters for creating a credential with refresh support.
- tokenstring必填
  Static bearer token value.
- networkingobject必填
  Outbound hosts the secret value is substituted on.
- secret_namestring必填
  Name of the environment variable. Immutable after create.
- secret_valuestring必填
  Secret value. Write-only; never returned in responses.
- injection_locationobject可选
  Where in the outbound request the secret value may be substituted.
display_namestring可选
Human-readable name for the credential. Up to 255 characters.
metadataobject可选
Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

200

支持 environment_variable 与 static_bearer。environment_variable 的 networking 只支持 limited，传 unrestricted 返回 400；secret_name 只能使用大写字母、数字和下划线，且不能以数字开头；injection_location 的默认值与官方一致。static_bearer 的令牌只在 mcp_server_url 所在主机上可用。创建或更新 mcp_oauth 返回 501（not_implemented_error），不产生副作用，官方 SDK 不会重试；需要 OAuth 令牌时请使用 /vault/v1/authorizations 一键授权。每个库最多 20 个有效凭据。以 anthropic. 开头的 metadata 键由平台保留，不能写入。

错误按 Claude Managed Agents 格式返回，参见错误码

响应

HTTP 200

Successful response

application/json

名称	类型	说明
id	string	Unique identifier for the credential.
archived_at	null \| string	A timestamp in RFC 3339 format
auth	object	Authentication details for a credential.
auth.mcp_server_url	string	URL of the MCP server this credential authenticates against.
auth.type	string
auth.expires_at	null \| string	A timestamp in RFC 3339 format
auth.refresh	null \| object	OAuth refresh token configuration returned in credential responses.
auth.injection_location	object	Where in the outbound request the secret value is substituted.
auth.networking	object	Outbound hosts the secret value is substituted on.
auth.secret_name	string	Name of the environment variable.
created_at	string	A timestamp in RFC 3339 format
metadata	object	Arbitrary key-value metadata attached to the credential.
type	string
updated_at	string	A timestamp in RFC 3339 format
vault_id	string	Identifier of the vault this credential belongs to.
display_name	null \| string	Human-readable name for the credential.

MCP OAuth 创建限制

上面的示例创建 environment_variable 凭据。创建 mcp_oauth 仍返回 501，不会创建凭据；更新已有 mcp_oauth 凭据也不支持。以下为创建请求的实测错误响应。

{
  "type": "error",
  "error": {
    "type": "not_implemented_error",
    "message": "Not implemented: creating mcp_oauth credentials is not available on this platform yet; use static_bearer or environment_variable."
  },
  "request_id": "4c1dcdba-97bb-46ce-aad0-0a7d8753357c"
}