Credentials

Credentials store the access keys and tokens for your compute environments, Git hosting services, and container registries in Seqera Platform.

Container registry credentials are used by the Wave container service to authenticate to private and public container registries like Docker Hub, Google Artifact Registry, Quay, etc.

Path and query parameters

Name	Type	Location	Req/Opt	Description
workspaceId	integer	query	Optional	Workspace identifier
platformId	string	query	Optional	Platform identifier
useExternalId	boolean	query	Optional	If true, generates a Platform-managed External ID for AWS credentials configured with an IAM role ARN.
provider	string	query	Required	Credentials provider to return setup values for, such as aws or google. Other providers return an empty setupValues array.
name	string	query	Optional	Credentials name to validate
credentialsId	string	path	Required	Credentials identifier
checked	boolean	query	Optional	If set credentials deletion will be blocked by running jobs that depend on them
pairingId	string	query	Optional	Encryption key identifier for encrypting the returned credentials.
force	boolean	query	Optional	If true, skip the probe and force the credential (INVALID only) to AVAILABLE. Rejected with 409 for any other status.

Request body parameters

Name	Type	Req/Opt	Description
CreateCredentials			Create credentials
credentials	object	Optional	Cloud provider or service credentials for authentication. Used to connect compute environments, access storage, and integrate with external services.
credentials.id	string	Optional	Credentials identifier.
credentials.name	string	Required	Unique name for the credentials. Must be 1-100 alphanumeric, dash, or underscore characters.
credentials.description	string	Optional	Optional description of the credentials and their intended use.
credentials.provider	string	Required	Credentials provider type. One of aws, azure, azure_entra, google, github, github_app, gitlab, bitbucket, ssh, k8s, container-reg, tw-agent, codecommit, gitea, azurerepos, seqeracompute, azure-cloud, or s3. Maximum 16 characters.
credentials.baseUrl	string	Optional	Base URL for the container registry server. Required for container registry credentials — defaults to docker.io).
credentials.category	string	Optional	Credential category used to group providers by purpose, for example cloud-compute, scm-host, or container-reg.
credentials.deleted	boolean	Optional	If true, the credential record has been soft-deleted and is retained only for internal reference.
credentials.lastUsed	string	Optional	Timestamp when the credentials were last used by Seqera Platform.
credentials.dateCreated	string	Optional	Timestamp when the credential record was created.
credentials.lastUpdated	string	Optional	Timestamp when the credential record was last updated.
credentials.keys	object	Optional	Authentication keys and secrets for a credentials record. The concrete schema is selected by the discriminator value, which matches the parent provider field.
credentials.keys.discriminator	string	Optional	Read-only provider discriminator for the concrete credentials payload. This value identifies which keys schema applies and matches the parent provider field.
credentials.lastValidated	string	Optional	Timestamp of the most recent completed validation probe, whether it succeeded or the provider authoritatively rejected the credentials. Transient probe failures do not update this value. Can be null if the credentials have never been validated.
credentials.message	string	Optional	Provider-supplied error detail captured when status changes to INVALID. Cleared to null when status returns to AVAILABLE. Maximum 4096 characters: longer provider messages are truncated and end with the suffix (truncated).
credentials.status	object	Optional	Credentials validation status: AVAILABLE if the last probe succeeded or no probe has run yet, or INVALID if the provider authoritatively rejected the last probe (see message). Transient probe failures, such as network errors or 5xx responses, leave this value unchanged.
UpdateCredentials			Update credentials
credentials	object	Optional	Cloud provider or service credentials for authentication. Used to connect compute environments, access storage, and integrate with external services.
credentials.id	string	Optional	Credentials identifier.
credentials.name	string	Required	Unique name for the credentials. Must be 1-100 alphanumeric, dash, or underscore characters.
credentials.description	string	Optional	Optional description of the credentials and their intended use.
credentials.provider	string	Required	Credentials provider type. One of aws, azure, azure_entra, google, github, github_app, gitlab, bitbucket, ssh, k8s, container-reg, tw-agent, codecommit, gitea, azurerepos, seqeracompute, azure-cloud, or s3. Maximum 16 characters.
credentials.baseUrl	string	Optional	Base URL for the container registry server. Required for container registry credentials — defaults to docker.io).
credentials.category	string	Optional	Credential category used to group providers by purpose, for example cloud-compute, scm-host, or container-reg.
credentials.deleted	boolean	Optional	If true, the credential record has been soft-deleted and is retained only for internal reference.
credentials.lastUsed	string	Optional	Timestamp when the credentials were last used by Seqera Platform.
credentials.dateCreated	string	Optional	Timestamp when the credential record was created.
credentials.lastUpdated	string	Optional	Timestamp when the credential record was last updated.
credentials.keys	object	Optional	Authentication keys and secrets for a credentials record. The concrete schema is selected by the discriminator value, which matches the parent provider field.
credentials.keys.discriminator	string	Optional	Read-only provider discriminator for the concrete credentials payload. This value identifies which keys schema applies and matches the parent provider field.
credentials.lastValidated	string	Optional	Timestamp of the most recent completed validation probe, whether it succeeded or the provider authoritatively rejected the credentials. Transient probe failures do not update this value. Can be null if the credentials have never been validated.
credentials.message	string	Optional	Provider-supplied error detail captured when status changes to INVALID. Cleared to null when status returns to AVAILABLE. Maximum 4096 characters: longer provider messages are truncated and end with the suffix (truncated).
credentials.status	object	Optional	Credentials validation status: AVAILABLE if the last probe succeeded or no probe has run yet, or INVALID if the provider authoritatively rejected the last probe (see message). Transient probe failures, such as network errors or 5xx responses, leave this value unchanged.