Skip to content
Docs

Application Credentials

API Reference
Zones

Application Credentials

List application credentials
client.zones.applicationCredentials.list(stringzoneID, ApplicationCredentialListParams { after, applicationId, before, 4 more } query?, RequestOptionsoptions?): ApplicationCredentialListResponse { items, page_info, pagination }
GET/zones/{zoneId}/application-credentials
Create application credential
client.zones.applicationCredentials.create(stringzoneID, ApplicationCredentialCreateParamsbody, RequestOptionsoptions?): ApplicationCredentialCreateResponse
POST/zones/{zoneId}/application-credentials
Get application credential
client.zones.applicationCredentials.retrieve(stringid, ApplicationCredentialRetrieveParams { zoneId } params, RequestOptionsoptions?): Credential
GET/zones/{zoneId}/application-credentials/{id}
Update application credential
client.zones.applicationCredentials.update(stringid, ApplicationCredentialUpdateParamsparams, RequestOptionsoptions?): Credential
PATCH/zones/{zoneId}/application-credentials/{id}
Delete application credential
client.zones.applicationCredentials.delete(stringid, ApplicationCredentialDeleteParams { zoneId } params, RequestOptionsoptions?): void
DELETE/zones/{zoneId}/application-credentials/{id}
ModelsExpand Collapse
BaseFields { id, application_id, created_at, 5 more }

Common fields shared by all application credential types

id: string

Unique identifier of the credential

application_id: string

ID of the application this credential belongs to

created_at: string

Entity creation timestamp

formatdate-time
organization_id: string

Organization that owns this credential

slug: string

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this credential belongs to

Deprecatedapplication?: Application { id, consent, created_at, 11 more }

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

id: string

Unique identifier of the application

Accepts one of the following:
created_at: string

Entity creation timestamp

formatdate-time
dependencies_count: number

Number of resource dependencies

identifier: string

User specified identifier, unique within the zone

minLength1
maxLength2048
name: string

Human-readable name

minLength1
maxLength255
organization_id: string

Organization that owns this application

owner_type: "platform" | "customer"

Who owns this application. Platform-owned applications cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: string

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this application belongs to

description?: string | null

Human-readable description

maxLength2048
metadata?: Metadata { docs_url, icon_url }

Entity metadata

docs_url?: string

Documentation URL

formaturi
maxLength2048
icon_url?: string

Icon URL

formaturi
maxLength2048
protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

post_logout_redirect_uris?: Array<string> | null

OAuth 2.0 post-logout redirect URIs for this application

redirect_uris?: Array<string> | null

OAuth 2.0 redirect URIs for this application

Credential = Token { identifier, provider_id, type, 2 more } | Password { identifier, type, password } | PublicKey { identifier, jwks_uri, type } | 2 more

Credentials for accessing external services from applications

Accepts one of the following:
Token extends BaseFields { id, application_id, created_at, 5 more } { identifier, provider_id, type, 2 more }

Token-based application credential

identifier: string

Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.

provider_id: string

ID of the provider issuing tokens verified by this credential

type: "token"
Deprecatedprovider?: Provider { id, created_at, identifier, 12 more }

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: string

Unique identifier of the provider

created_at: string

Entity creation timestamp

formatdate-time
identifier: string

User specified identifier, unique within the zone

minLength1
maxLength2048
name: string

Human-readable name

minLength1
maxLength255
organization_id: string

Organization that owns this provider

owner_type: "platform" | "customer"

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: string

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this provider belongs to

client_id?: string | null

OAuth 2.0 client identifier

client_secret_set?: boolean

Indicates whether a client secret is configured

description?: string | null

Human-readable description

maxLength2048
metadata?: Metadata | null

Provider metadata

icon_url?: string

Icon URL

formaturi
maxLength2048
protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

issuer: string

OIDC issuer URL used for discovery and token validation.

formaturi
authorization_endpoint?: string | null
formaturi
authorization_parameters?: Record<string, string> | null

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled?: boolean | null

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter?: string | null

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported?: Array<string> | null
jwks_uri?: string | null
formaturi
registration_endpoint?: string | null
formaturi
scope_parameter?: string | null

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator?: string | null

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported?: Array<string> | null
token_endpoint?: string | null
formaturi
token_response_access_token_pointer?: string | null

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid?: Openid | null

OpenID Connect protocol configuration

external_id_claim?: string | null

Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

scopes?: Array<string> | null

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

single_logout_enabled?: boolean | null

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

user_identifier_claim?: string | null

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint?: string | null
formaturi
type?: "external" | "keycard-vault" | "keycard-sts"
Accepts one of the following:
"external"
"keycard-vault"
"keycard-sts"
subject?: string | null

Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.

Password extends BaseFields { id, application_id, created_at, 5 more } { identifier, type, password }

Password-based application credential

identifier: string

Username for password credential, also used as OAuth 2.0 client ID

type: "password"
password?: string

Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret

PublicKey extends BaseFields { id, application_id, created_at, 5 more } { identifier, jwks_uri, type }

Public key-based application credential

identifier: string

Client ID for public key credential, also used as OAuth 2.0 client ID

jwks_uri: string

JWKS URI to retrieve public keys from

formaturi
type: "public-key"
URL extends BaseFields { id, application_id, created_at, 5 more } { identifier, type }

URL-based application credential

identifier: string

URL of the credential (must be a valid URL)

formaturi
type: "url"
Public extends BaseFields { id, application_id, created_at, 5 more } { identifier, type }

Public credential (no secret storage)

identifier: string

Identifier for public credential, also used as OAuth 2.0 client ID

type: "public"
Password extends BaseFields { id, application_id, created_at, 5 more } { identifier, type, password }

Password-based application credential

identifier: string

Username for password credential, also used as OAuth 2.0 client ID

type: "password"
password?: string

Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret

Public extends BaseFields { id, application_id, created_at, 5 more } { identifier, type }

Public credential (no secret storage)

identifier: string

Identifier for public credential, also used as OAuth 2.0 client ID

type: "public"
PublicKey extends BaseFields { id, application_id, created_at, 5 more } { identifier, jwks_uri, type }

Public key-based application credential

identifier: string

Client ID for public key credential, also used as OAuth 2.0 client ID

jwks_uri: string

JWKS URI to retrieve public keys from

formaturi
type: "public-key"
Token extends BaseFields { id, application_id, created_at, 5 more } { identifier, provider_id, type, 2 more }

Token-based application credential

identifier: string

Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.

provider_id: string

ID of the provider issuing tokens verified by this credential

type: "token"
Deprecatedprovider?: Provider { id, created_at, identifier, 12 more }

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: string

Unique identifier of the provider

created_at: string

Entity creation timestamp

formatdate-time
identifier: string

User specified identifier, unique within the zone

minLength1
maxLength2048
name: string

Human-readable name

minLength1
maxLength255
organization_id: string

Organization that owns this provider

owner_type: "platform" | "customer"

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:
"platform"
"customer"
slug: string

URL-safe identifier, unique within the zone

minLength1
maxLength63
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this provider belongs to

client_id?: string | null

OAuth 2.0 client identifier

client_secret_set?: boolean

Indicates whether a client secret is configured

description?: string | null

Human-readable description

maxLength2048
metadata?: Metadata | null

Provider metadata

icon_url?: string

Icon URL

formaturi
maxLength2048
protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

issuer: string

OIDC issuer URL used for discovery and token validation.

formaturi
authorization_endpoint?: string | null
formaturi
authorization_parameters?: Record<string, string> | null

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled?: boolean | null

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter?: string | null

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported?: Array<string> | null
jwks_uri?: string | null
formaturi
registration_endpoint?: string | null
formaturi
scope_parameter?: string | null

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator?: string | null

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported?: Array<string> | null
token_endpoint?: string | null
formaturi
token_response_access_token_pointer?: string | null

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid?: Openid | null

OpenID Connect protocol configuration

external_id_claim?: string | null

Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

scopes?: Array<string> | null

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

single_logout_enabled?: boolean | null

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

user_identifier_claim?: string | null

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint?: string | null
formaturi
type?: "external" | "keycard-vault" | "keycard-sts"
Accepts one of the following:
"external"
"keycard-vault"
"keycard-sts"
subject?: string | null

Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.

URL extends BaseFields { id, application_id, created_at, 5 more } { identifier, type }

URL-based application credential

identifier: string

URL of the credential (must be a valid URL)

formaturi
type: "url"