Documentation Index
Fetch the complete documentation index at: https://docs.qoder.com/llms.txt
Use this file to discover all available pages before exploring further.
POST /v1/vaults/{vault_id}/credentials
Adds a new MCP server credential to the specified vault.
Path parameters
| Parameter | Type | Required | Description |
|---|
vault_id | string | Yes | Vault unique identifier |
| Header | Required | Description |
|---|
Authorization | Yes | Bearer $QODER_PAT |
Content-Type | Yes | application/json |
Request body
| Field | Type | Required | Description |
|---|
mcp_server_url | string | Yes | Full URL of the MCP server |
protocol | string | Yes | Communication protocol. One of: sse, streamable_http |
type | string | Yes | Credential type. Currently only static_bearer is supported |
access_token | string | Yes | Access token (required for static_bearer type) |
Example request
curl -X POST https://openapi.qoder.sh/api/v1/cloud/vaults/vault_019e3bb940277f0db05ab74291acf6ef/credentials \
-H "Authorization: Bearer $QODER_PAT" \
-H "Content-Type: application/json" \
-d '{
"mcp_server_url": "https://example.com/mcp-stream",
"protocol": "streamable_http",
"type": "static_bearer",
"access_token": "your-access-token"
}'
Example response
HTTP 201 Created
{
"id": "vcred_019e3bb98877759e862750b495c1fce8",
"vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
"mcp_server_url": "https://example.com/mcp-stream",
"protocol": "streamable_http",
"type": "static_bearer",
"status": "active",
"created_at": "2026-05-18T15:34:35.387093Z",
"updated_at": "2026-05-18T15:34:35.387093Z"
}
Response fields
| Field | Type | Description |
|---|
id | string | Credential unique identifier with the vcred_ prefix |
vault_id | string | Owning Vault ID |
mcp_server_url | string | MCP server URL |
protocol | string | Protocol type: sse or streamable_http |
type | string | Credential type |
status | string | Status: active |
created_at | string | Creation time (ISO 8601) |
updated_at | string | Last update time (ISO 8601) |
Errors
| HTTP | Type | Trigger |
|---|
| 400 | invalid_request_error | Missing required field: “Field ‘access_token’ is required for static_bearer type.” |
| 401 | TOKEN_INVALID | Missing or invalid authentication token |
| 404 | not_found_error | Vault does not exist or has been deleted |
Notes
- The response does not return the value of
access_token (for security reasons).
- A vault can hold multiple credentials.
- Credentials are
active immediately after creation.
See Errors for the full error envelope.
