# Credentials

Scoped credentials are branch-anchored tokens for workloads that can't use a user session, such as CI jobs, servers, and S3 clients. One credential API serves multiple Neon services, and the scopes you request determine what a credential can do. Each service documents its own scopes.

The create response returns `api_token` and `s3_secret_access_key` exactly once, and they can't be retrieved again; list responses return metadata only. To rotate, create a new credential, update your environment, then revoke the old one.

A credential is valid on the branch it was created on and any branch descended from it, but not on branches outside that lineage.

See [Object Storage authentication](/docs/storage/authentication) and [AI Gateway authentication](/docs/ai-gateway/authentication) for scope details and client setup.

---

> API Reference / Credentials / Issue a scoped credential on the branch

## POST /projects/{project_id}/branches/{branch_id}/credentials

Issues a new scoped service credential anchored to the specified
branch. The response carries `api_token` and `s3_secret_access_key`
exactly once — they are not stored server-side.

**Note**: This endpoint is currently in Beta.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID

### Request body

- `name` (string, optional)
  Free-form customer label for the credential.
- `scopes` (array, required)
- `principal_type` (string, required)
  Principal type for the credential. Only `user` is customer-managed
  and accepted here. `function` and `system` credentials are
  platform-internal (e.g. function-serve auto-mint, presign signer)
  and are never issued through the customer-facing API.
  
  Possible values: `user`

### Response (201)

```json
{
  "token_id": "<token_id>",
  "token_id_short": "<token_id_short>",
  "name": "my-credential",
  "api_token": "<api_token>",
  "s3_secret_access_key": "<s3_secret_access_key>",
  "scopes": [
    "storage:read"
  ],
  "branch_id": "br-young-forest-a5b6c7d8",
  "created_at": "2025-01-15T10:30:00Z"
}
```

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/credentials" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.createCredential({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID
  }
});
```

### Errors

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

---

> API Reference / Credentials / List credentials on the branch

## GET /projects/{project_id}/branches/{branch_id}/credentials

Returns metadata for customer-issued credentials on the branch.
Secrets are never included.

**Note**: This endpoint is currently in Beta.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID

### Response (200)

```json
{
  "credentials": [
    {
      "token_id": "<token_id>",
      "token_id_short": "<token_id_short>",
      "name": "ai-gateway-client",
      "scopes": [
        "ai_gateway:invoke"
      ],
      "principal_type": "user",
      "created_at": "2025-01-15T10:30:00Z"
    },
    {
      "token_id": "<token_id>",
      "token_id_short": "<token_id_short>",
      "name": "storage-writer",
      "scopes": [
        "storage:read",
        "storage:write"
      ],
      "principal_type": "user",
      "created_at": "2025-01-15T10:30:00Z"
    },
    {
      "token_id": "<token_id>",
      "token_id_short": "<token_id_short>",
      "name": "storage-reader",
      "scopes": [
        "storage:read"
      ],
      "principal_type": "user",
      "created_at": "2025-01-15T10:30:00Z"
    }
  ]
}
```

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/credentials" \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.listCredentials({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID
  }
});
```

### Errors

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

---

> API Reference / Credentials / Reveal a credential's secrets

## POST /projects/{project_id}/branches/{branch_id}/credentials/{token_id}/reveal

Returns the live `api_token` and `s3_secret_access_key` of an existing
credential, so a credential whose issuance response was lost can be
recovered without minting a new one.

This is a POST with an explicit `/reveal` verb so the secrets never ride
a GET, where they would land in access logs, browser history and proxy
caches. Revoked and expired credentials return 404, as does a
`token_id` that does not belong to this project.

A credential issued before secret retrieval was supported has no
recoverable secret and returns 409 — rotate it to obtain one.

**Note**: This endpoint is currently in Beta.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID
- `token_id` (string, path, required)
  The opaque credential id (e.g. nak_live_<32hex>).

### Response (200)

- `token_id` (string, optional)
  Opaque credential id (e.g. nak_live_<32hex>).
- `api_token` (string, optional)
  Bearer token.
- `s3_secret_access_key` (string, optional)
  nsk_live_<64 hex>; the AWS_SECRET_ACCESS_KEY.

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/credentials/$TOKEN_ID/reveal" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.revealCredential({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID,
    token_id: process.env.TOKEN_ID
  }
});
```

### Errors

**404**
Credential not found
- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

**409**
The credential exists but has no recoverable secret because it was
issued before secret retrieval was supported. Rotate the credential
to obtain a recoverable secret.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

---

> API Reference / Credentials / Revoke a credential

## DELETE /projects/{project_id}/branches/{branch_id}/credentials/{token_id}

Soft-deletes the credential.  Idempotent.

**Note**: This endpoint is currently in Beta.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID
- `token_id` (string, path, required)
  The opaque credential id (e.g. nak_live_<32hex>).

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/credentials/$TOKEN_ID" \
  -X DELETE \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.revokeCredential({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID,
    token_id: process.env.TOKEN_ID
  }
});
```

### Errors

**404**
Credential not found
- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message

---

> API Reference / Credentials / Rotate a credential's secrets

## POST /projects/{project_id}/branches/{branch_id}/credentials/{token_id}/rotate

Replaces the secret material on an existing scoped credential in
place. `token_id` is preserved — it is the `AWS_ACCESS_KEY_ID` for
S3-compatible clients, so the access key id your application already
holds keeps working and only the secret changes. This is the analog of
resetting a Postgres password, not of issuing a second credential.

The response carries the new `api_token` and `s3_secret_access_key`
exactly once. Rotation is **not** idempotent: retrying after an
ambiguous timeout mints another secret and supersedes the previous
replacement, so a retry does not recover a lost response — it only
invalidates the secret you did not receive. If you lose the response,
issue a replacement credential and revoke this one.

The old secret stops authenticating as soon as the rotation commits.
Where a region caches credentials on its data-plane verifiers, a
replica may briefly keep accepting the old secret — and rejecting the
new one — until its cache entry expires; where it does not, the
cutover is immediate apart from requests already in flight. Either way
the changeover is not atomic across replicas, so retry an unexpected
authentication failure right after rotating rather than treating the
new secret as bad. `last_used_at` continues to report the logical
credential's prior usage and says nothing about whether the new secret
has been used yet.

Only a live, unexpired, unrevoked customer-managed (`user`) credential
on a live project and live branch is eligible. Anything else —
including the platform-internal `function` and `system` credentials —
is reported as not found, indistinguishable from an unknown
`token_id`.

**Note**: This endpoint is currently in Beta.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID
- `token_id` (string, path, required)
  The opaque credential id (e.g. nak_live_<32hex>).

### Response (200)

- `token_id` (string, optional)
  Opaque credential id (e.g. nak_live_<32hex>), unchanged by the
  rotation. Doubles as the `AWS_ACCESS_KEY_ID` for SigV4.
  
- `token_id_short` (string, optional)
  First 12 hex chars of token_id; safe to log.
- `name` (string, optional)
  Customer-supplied label carried on the credential. Absent when none was set at issuance.
- `api_token` (string, optional)
  The new Bearer token; returned exactly once.
- `s3_secret_access_key` (string, optional)
  The new nsk_live_<64 hex> AWS_SECRET_ACCESS_KEY; returned exactly once.
- `scopes` (array, optional)
- `branch_id` (string, optional)
- `principal_type` (string, optional)
  Always `user`: only customer-managed credentials are rotatable
  through this endpoint.
  
  Possible values: `user`
- `created_at` (string, optional, format: date-time)
  When the credential was originally issued. Rotation replaces the
  secrets in place and does not reset this.
  
- `expires_at` (string, optional, format: date-time)
  When the credential expires; absent means never expires. Rotation
  does not extend it.
  

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/credentials/$TOKEN_ID/rotate" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.rotateCredential({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID,
    token_id: process.env.TOKEN_ID
  }
});
```

### Errors

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message