Store an integration credential

Módulo Settings

POST/integrations/{id}/credentialintegrations.storeCredential

Stores or rotates the connection's secret in Supabase Vault. The secret is never returned. Requires `Idempotency-Key`; a replay returns the original response. A rule that refuses the request returns 422 with `refusal` and `reason`.

Requiere la capacidad org.integrations.manage.
Alcances de OAuth: org.
Envía el encabezado Idempotency-Key. Una repetición con la misma clave devuelve la respuesta original.
Estados de error: 400, 401, 404, 409, 422, 429. Los errores son detalles de problema RFC 9457.

Parámetros de ruta y de consulta

integrations.storeCredential: Parámetros de ruta y de consulta
Campo	Tipo	Obligatorio	Descripción
id	string (uuid)	Sí	Identifier of the integration.

Cuerpo de la solicitud: IntegrationCredential

integrations.storeCredential: IntegrationCredential
Campo	Tipo	Obligatorio	Descripción
secret	string	Sí	The provider secret or OAuth token set. Write-only: stored in Vault, never returned.Restricciones: length 1 to 16384
kind	"OAuth Token" \| "API Key" \| "Service Account"	Sí	Kind of secret.
expires_at	string (date-time) \| null	No	When the secret expires, when the provider says.

{
  "secret": "{\"access_token\":\"...\"}",
  "kind": "OAuth Token",
  "expires_at": "2026-10-08T14:30:00Z"
}

Respuesta 200: Integration

integrations.storeCredential: Integration
Campo	Tipo	Obligatorio	Descripción
id	string (uuid)	Sí	Identifier of the integration.
org_id	string (uuid)	Sí	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Sí	When the row was created.
created_by	string (uuid) \| null	Sí	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Sí	When the row was last updated.
updated_by	string (uuid) \| null	Sí	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
provider_code	string	Sí	Provider.Restricciones: pattern ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
last_synced_at	string (date-time) \| null	Sí	Last successful sync.
display_name	string	Sí	Name the org gives the connection.Restricciones: length 1 to 120
external_account_id	string \| null	Sí	Provider tenant, company or workspace id.Restricciones: length 1 to 255
connection_state	"Pending" \| "Connected" \| "Error" \| "Paused" \| "Disconnected"	Sí	Connection state; changes through the transitions action.
credential_kind	"OAuth Token" \| "API Key" \| "Service Account" \| null	Sí	Kind of the stored Vault credential.
credential_expires_at	string (date-time) \| null	Sí	When the stored credential expires.
last_error_code	string \| null	Sí	Rule code of the last connection error.Restricciones: pattern ^[a-z][a-z0-9_]*$
last_error_message	string \| null	Sí	Provider message of the last connection error.Restricciones: length 1 to 1000

{
  "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "created_at": "2026-10-08T14:30:00Z",
  "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "updated_at": "2026-10-08T14:30:00Z",
  "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "provider_code": "xero",
  "last_synced_at": "2026-10-08T14:30:00Z",
  "display_name": "Northwind Xero",
  "external_account_id": "tenant-nwl",
  "connection_state": "Connected",
  "credential_kind": "OAuth Token",
  "credential_expires_at": "2026-10-08T14:30:00Z",
  "last_error_code": "credential_refused",
  "last_error_message": "Xero refused the token."
}

Ejemplos de código

curl -X POST "$XOS_BASE_URL/integrations/0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f/credential" \
  -H "Authorization: Bearer $XOS_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"secret":"{\"access_token\":\"...\"}","kind":"OAuth Token","expires_at":"2026-10-08T14:30:00Z"}'

const { data } = await xos.integrations.storeCredential("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {
    "secret": "{\"access_token\":\"...\"}",
    "kind": "OAuth Token",
    "expires_at": "2026-10-08T14:30:00Z"
  });

response = xos.integrations.store_credential("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {"secret": "{\"access_token\":\"...\"}", "kind": "OAuth Token", "expires_at": "2026-10-08T14:30:00Z"})

xos integrations store-credential 0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f --data '{"secret":"{\"access_token\":\"...\"}","kind":"OAuth Token","expires_at":"2026-10-08T14:30:00Z"}'