Update credential

curl --request PATCH \
  --url https://api.onkernel.com/credentials/{id_or_name} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "my-updated-login",
  "remove_value_keys": [
    "old_field"
  ],
  "sso_provider": "google",
  "totp_secret": "JBSWY3DPEHPK3PXP",
  "values": {
    "password": "newpassword",
    "username": "user@example.com"
  }
}
'

import requests

url = "https://api.onkernel.com/credentials/{id_or_name}"

payload = {
    "name": "my-updated-login",
    "remove_value_keys": ["old_field"],
    "sso_provider": "google",
    "totp_secret": "JBSWY3DPEHPK3PXP",
    "values": {
        "password": "newpassword",
        "username": "user@example.com"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'my-updated-login',
    remove_value_keys: ['old_field'],
    sso_provider: 'google',
    totp_secret: 'JBSWY3DPEHPK3PXP',
    values: {password: 'newpassword', username: 'user@example.com'}
  })
};

fetch('https://api.onkernel.com/credentials/{id_or_name}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onkernel.com/credentials/{id_or_name}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'my-updated-login',
    'remove_value_keys' => [
        'old_field'
    ],
    'sso_provider' => 'google',
    'totp_secret' => 'JBSWY3DPEHPK3PXP',
    'values' => [
        'password' => 'newpassword',
        'username' => 'user@example.com'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onkernel.com/credentials/{id_or_name}"

	payload := strings.NewReader("{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.onkernel.com/credentials/{id_or_name}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onkernel.com/credentials/{id_or_name}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "created_at": "2025-01-15T10:30:00Z",
  "domain": "netflix.com",
  "id": "cred_abc123xyz",
  "name": "my-netflix-login",
  "updated_at": "2025-01-15T10:30:00Z",
  "has_totp_secret": false,
  "has_values": true,
  "sso_provider": "google",
  "totp_code": "847291",
  "totp_code_expires_at": "2025-01-15T10:30:30Z",
  "value_keys": [
    "username",
    "password"
  ]
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

PATCH

credentials

{id_or_name}

Update credential

curl --request PATCH \
  --url https://api.onkernel.com/credentials/{id_or_name} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "my-updated-login",
  "remove_value_keys": [
    "old_field"
  ],
  "sso_provider": "google",
  "totp_secret": "JBSWY3DPEHPK3PXP",
  "values": {
    "password": "newpassword",
    "username": "user@example.com"
  }
}
'

import requests

url = "https://api.onkernel.com/credentials/{id_or_name}"

payload = {
    "name": "my-updated-login",
    "remove_value_keys": ["old_field"],
    "sso_provider": "google",
    "totp_secret": "JBSWY3DPEHPK3PXP",
    "values": {
        "password": "newpassword",
        "username": "user@example.com"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'my-updated-login',
    remove_value_keys: ['old_field'],
    sso_provider: 'google',
    totp_secret: 'JBSWY3DPEHPK3PXP',
    values: {password: 'newpassword', username: 'user@example.com'}
  })
};

fetch('https://api.onkernel.com/credentials/{id_or_name}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onkernel.com/credentials/{id_or_name}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'my-updated-login',
    'remove_value_keys' => [
        'old_field'
    ],
    'sso_provider' => 'google',
    'totp_secret' => 'JBSWY3DPEHPK3PXP',
    'values' => [
        'password' => 'newpassword',
        'username' => 'user@example.com'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onkernel.com/credentials/{id_or_name}"

	payload := strings.NewReader("{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.onkernel.com/credentials/{id_or_name}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onkernel.com/credentials/{id_or_name}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"my-updated-login\",\n  \"remove_value_keys\": [\n    \"old_field\"\n  ],\n  \"sso_provider\": \"google\",\n  \"totp_secret\": \"JBSWY3DPEHPK3PXP\",\n  \"values\": {\n    \"password\": \"newpassword\",\n    \"username\": \"user@example.com\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "created_at": "2025-01-15T10:30:00Z",
  "domain": "netflix.com",
  "id": "cred_abc123xyz",
  "name": "my-netflix-login",
  "updated_at": "2025-01-15T10:30:00Z",
  "has_totp_secret": false,
  "has_values": true,
  "sso_provider": "google",
  "totp_code": "847291",
  "totp_code_expires_at": "2025-01-15T10:30:30Z",
  "value_keys": [
    "username",
    "password"
  ]
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

{
  "code": "bad_request",
  "message": "Missing required field: app_name",
  "details": [
    {
      "code": "invalid_input",
      "message": "Provided version string is not semver compliant"
    }
  ],
  "inner_error": {
    "code": "invalid_input",
    "message": "Provided version string is not semver compliant"
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id_or_name

string

required

Credential ID or name

Body

application/json

Request to update an existing credential

name

string

New name for the credential

Example:

"my-updated-login"

remove_value_keys

string[]

Field names to remove from the credential's stored values. Removals are applied before values are merged, so a key present in both is kept with its new value.

Example:

["old_field"]

sso_provider

string | null

If set, indicates this credential should be used with the specified SSO provider. Set to empty string or null to remove.

Example:

"google"

totp_secret

string

Base32-encoded TOTP secret for generating one-time passwords. Spaces and formatting are automatically normalized. Set to empty string to remove.

Example:

"JBSWY3DPEHPK3PXP"

values

object

Field name to value mapping. Values are merged with existing values (new keys added, existing keys overwritten).

Show child attributes

Example:

{
  "password": "newpassword",
  "username": "user@example.com"
}

Response

Credential updated successfully

A stored credential for automatic re-authentication

created_at

string<date-time>

required

When the credential was created

Example:

"2025-01-15T10:30:00Z"

domain

string

required

Target domain this credential is for

Example:

"netflix.com"

string

required

Unique identifier for the credential

Example:

"cred_abc123xyz"

name

string

required

Unique name for the credential within the project

Example:

"my-netflix-login"

updated_at

string<date-time>

required

When the credential was last updated

Example:

"2025-01-15T10:30:00Z"

has_totp_secret

boolean

Whether this credential has a TOTP secret configured for automatic 2FA

Example:

false

has_values

boolean

Whether this credential has stored values (email, password, etc.)

Example:

true

sso_provider

string | null

If set, indicates this credential should be used with the specified SSO provider (e.g., google, github, microsoft). When the target site has a matching SSO button, it will be clicked first before filling credential values on the identity provider's login page.

Example:

"google"

totp_code

string

Current 6-digit TOTP code. Only included in create/update responses when totp_secret was just set.

Example:

"847291"

totp_code_expires_at

string<date-time>

When the totp_code expires. Only included when totp_code is present.

Example:

"2025-01-15T10:30:30Z"

value_keys

string[]

The field names stored in this credential's values (e.g., username, password). Values themselves are never returned. Included on single-credential responses (create, get by id or name, update); omitted from list responses.

Example:

["username", "password"]

Apps

Audit Logs

Managed Auth

Authentication

Browser Pools

Browsers

Browser Computer Controls

Browser Filesystem

Browser Logs

Browser Playwright

Browser Processes

Browser REPL

Browser Replays

Browser Telemetry

Browser WebMCP

Config Registry

Deployments

Extensions

Invocations

API Keys

Organization

Projects

Profiles

Proxies

Vaults

Update credential

Authorizations

Path Parameters

Body

Response