Skip to main content
POST /v1/vaults/{vault_id}/credentials Adds a new MCP server credential to the specified vault.

​
Path parameters

ParameterTypeRequiredDescription
vault_idstringYesVault unique identifier

​
Headers

HeaderRequiredDescription
AuthorizationYesBearer $QODER_PAT
Content-TypeYesapplication/json

​
Request body

FieldTypeRequiredDescription
mcp_server_urlstringYesFull URL of the MCP server
protocolstringYesCommunication protocol. One of: sse, streamable_http
typestringYesCredential type. Currently only static_bearer is supported
access_tokenstringYesAccess token (required for static_bearer type)

​
Example request

curl -X POST https://api.qoder.com/api/v1/cloud/vaults/vault_019e3bb940277f0db05ab74291acf6ef/credentials \
  -H "Authorization: Bearer $QODER_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "mcp_server_url": "https://example.com/mcp-stream",
    "protocol": "streamable_http",
    "type": "static_bearer",
    "access_token": "your-access-token"
  }'

​
Example response

HTTP 201 Created 
{
  "id": "vcred_019e3bb98877759e862750b495c1fce8",
  "vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
  "mcp_server_url": "https://example.com/mcp-stream",
  "protocol": "streamable_http",
  "type": "static_bearer",
  "status": "active",
  "created_at": "2026-05-18T15:34:35.387093Z",
  "updated_at": "2026-05-18T15:34:35.387093Z"
}

​
Response fields

FieldTypeDescription
idstringCredential unique identifier with the vcred_ prefix
vault_idstringOwning Vault ID
mcp_server_urlstringMCP server URL
protocolstringProtocol type: sse or streamable_http
typestringCredential type
statusstringStatus: active
created_atstringCreation time (ISO 8601)
updated_atstringLast update time (ISO 8601)

​
Errors

HTTPTypeTrigger
400invalid_request_errorMissing required field: “Field ‘access_token’ is required for static_bearer type.”
401TOKEN_INVALIDMissing or invalid authentication token
404not_found_errorVault does not exist or has been deleted

​
Notes

  • The response does not return the value of access_token (for security reasons).
  • A vault can hold multiple credentials.
  • Credentials are active immediately after creation.
See Errors for the full error envelope.