> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Create an API credential

POST https://api.sigmacomputing.com/v2/api-credentials
Content-Type: application/json

This endpoint creates a new API credential for use with API connectors and the **Call API** action in Sigma. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).

### Usage notes
- The user making this request must be assigned an account type with the **Manage API connectors** permission enabled.
- The `allowlist` parameter is required and must contain at least one hostname glob pattern. Use `["*"]` to allow the credential to be used against any host.
- The following authentication methods are supported: `basic`, `bearer`, `apiKey`, `oAuthClientCredentials`, `oAuthAuthorizationCode`, `oAuthPasswordCredentials`, `awsSigV4`.
- Secret fields are encrypted at rest and are never returned in subsequent read responses.

### Usage scenarios
- **Credential provisioning:** Automate credential creation as part of environment setup or onboarding.
- **Multi-service authentication:** Create separate credentials for each external service, with allowlists scoped to only that service's domains.

Reference: https://help.sigmacomputing.com/reference/create-api-credential

## Authentication

- OAuth2 — send the obtained token as `Authorization: Bearer <token>`

## Servers

- `https://api.sigmacomputing.com` (Server for GCP (US) hosted organizations, default)
- `https://api.sa.gcp.sigmacomputing.com` (Server for GCP (KSA) hosted organizations)
- `https://aws-api.sigmacomputing.com` (Server for AWS US (West) hosted organizations)
- `https://api.us-a.aws.sigmacomputing.com` (Server for AWS US (East) hosted organizations)
- `https://api.ca.aws.sigmacomputing.com` (Server for AWS Canada hosted organizations)
- `https://api.eu.aws.sigmacomputing.com` (Server for AWS Europe hosted organizations)
- `https://api.au.aws.sigmacomputing.com` (Server for AWS Australia and APAC hosted organizations)
- `https://api.uk.aws.sigmacomputing.com` (Server for AWS UK hosted organizations)
- `https://api.us.azure.sigmacomputing.com` (Server for Azure US hosted organizations)
- `https://api.eu.azure.sigmacomputing.com` (Server for Azure Europe hosted organizations)
- `https://api.ca.azure.sigmacomputing.com` (Server for Azure Canada hosted organizations)
- `https://api.uk.azure.sigmacomputing.com` (Server for Azure United Kingdom hosted organizations)
- `https://api.au.azure.sigmacomputing.com` (Server for Azure Australia hosted organizations)

## Request

### Body (application/json)

- `name` (string, required) — Display name of the credential.
- `allowlist` (list of string, required) — Hostname glob patterns the credential may be used against (e.g. `["*.example.com"]`). Required and must not be empty; use `["*"]` to allow every host.
- `credential` (object or object or object or object or object, required)
  - Basic
    - `authMethod` (enum, required)
      - Allowed values: `basic`
    - `basic` (object, required)
      - `username` (string, required) — Username for Basic authentication.
      - `password` (string, required) — Password for Basic authentication. Encrypted at rest; never returned in responses.
  - Bearer
    - `authMethod` (enum, required)
      - Allowed values: `bearer`
    - `bearer` (object, required)
      - `token` (string, required) — Bearer token. Encrypted at rest; never returned in responses.
  - API key
    - `authMethod` (enum, required)
      - Allowed values: `apiKey`
    - `apiKey` (object, required)
      - `key` (string, required) — Header or query parameter name carrying the API key.
      - `value` (string, required) — API key value. Encrypted at rest; never returned in responses.
      - `isQueryParam` (boolean, required) — Whether the key is sent as a query parameter; if false, it is sent as a header.
  - OAuth client credentials
    - `authMethod` (enum, required)
      - Allowed values: `oAuthClientCredentials`
    - `oAuthClientCredentials` (object, required)
      - `clientId` (string, required) — OAuth client ID.
      - `clientSecret` (string, required) — OAuth client secret. Encrypted at rest; never returned in responses.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes requested at token exchange.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
  - AWS SigV4
    - `authMethod` (enum, required)
      - Allowed values: `awsSigV4`
    - `awsSigV4` (object, required)
      - `accessKeyId` (string, required) — AWS access key ID.
      - `secretAccessKey` (string, required) — AWS secret access key. Encrypted at rest; never returned in responses.
      - `region` (string, optional) — AWS region for SigV4 signing.
      - `service` (string, optional) — AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
      - `sessionToken` (string, optional) — AWS STS session token for temporary credentials.
      - `temporaryCredentialsUrl` (string, optional) — URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
      - `temporaryCredentialsResponseMapping` (object, optional)
        - `accessKeyField` (string, optional)
        - `secretKeyField` (string, optional)
        - `sessionTokenField` (string, optional)
        - `expirationField` (string, optional)
      - `temporaryCredentialsRequestParams` (list of object, optional) — Additional key/value parameters attached to the temporary-credentials swap request. Each entry specifies whether it is sent as a request header, body field, or query parameter (`sendIn`: `header` | `body` | `queryParam`). Use this when the swap endpoint requires its own authentication (for example, an `x-api-key` header).
        - `key` (string, required)
        - `value` (string, required)
        - `sendIn` (enum, required)
          - Allowed values: `queryParam`, `body`, `header`
- `description` (string, optional) — Human-readable description.

## Response

### 200

The response body.

- `apiCredentialId` (string, required) — Unique identifier of the API credential.
- `name` (string, required) — Display name of the credential.
- `authMethod` (enum, required) — Authentication method the credential uses.
  - Allowed values: `basic`, `bearer`, `apiKey`, `oAuthClientCredentials`, `oAuthAuthorizationCode`, `oAuthPasswordCredentials`, `awsSigV4`
- `allowlist` (list of string, required) — Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
- `credential` (object or object or object or object or object or object or object, required) — Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
  - Basic
    - `authMethod` (enum, required)
      - Allowed values: `basic`
    - `basic` (object, optional)
      - `username` (string, required) — Username for Basic authentication.
  - Bearer
    - `authMethod` (enum, required)
      - Allowed values: `bearer`
  - API key
    - `authMethod` (enum, required)
      - Allowed values: `apiKey`
    - `apiKey` (object, optional)
      - `key` (string, required) — Header or query parameter name carrying the API key.
      - `isQueryParam` (boolean, required) — Whether the key is sent as a query parameter; if false, it is sent as a header.
  - OAuth client credentials
    - `authMethod` (enum, required)
      - Allowed values: `oAuthClientCredentials`
    - `oAuthClientCredentials` (object, optional)
      - `clientId` (string, required) — OAuth client ID.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes requested at token exchange.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
  - OAuth authorization code
    - `authMethod` (enum, required)
      - Allowed values: `oAuthAuthorizationCode`
    - `oAuthAuthorizationCode` (object, optional)
      - `clientId` (string, required) — OAuth client ID.
      - `authorizationUrl` (string, required) — OAuth authorization endpoint URL.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
  - OAuth password credentials
    - `authMethod` (enum, required)
      - Allowed values: `oAuthPasswordCredentials`
    - `oAuthPasswordCredentials` (object, optional)
      - `username` (string, required) — OAuth resource-owner username.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
      - `clientId` (string, optional) — OAuth client ID.
  - AWS SigV4
    - `authMethod` (enum, required)
      - Allowed values: `awsSigV4`
    - `awsSigV4` (object, optional)
      - `accessKeyId` (string, required) — AWS access key ID.
      - `region` (string, optional) — AWS region for SigV4 signing.
      - `service` (string, optional) — AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
      - `temporaryCredentialsUrl` (string, optional) — URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
      - `temporaryCredentialsResponseMapping` (object, optional)
        - `accessKeyField` (string, optional)
        - `secretKeyField` (string, optional)
        - `sessionTokenField` (string, optional)
        - `expirationField` (string, optional)
      - `temporaryCredentialsRequestParams` (list of object, optional) — Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`).
        - `key` (string, required)
        - `value` (string, required)
        - `sendIn` (enum, required)
          - Allowed values: `queryParam`, `body`, `header`
- `createdBy` (string, required) — The identifier of the user who created this object.
- `updatedBy` (string, required) — The identifier of the user or process that last updated this object.
- `createdAt` (datetime, required) — When the object was created.
- `updatedAt` (datetime, required) — When the object was last updated.
- `description` (string, optional) — Human-readable description.

## Examples

**Request**

```json
{
  "name": "string",
  "allowlist": [
    "string"
  ],
  "credential": {
    "authMethod": "basic",
    "basic": {
      "password": "string",
      "username": "string"
    }
  }
}
```

**Response**

```json
{
  "apiCredentialId": "string",
  "name": "string",
  "authMethod": "basic",
  "allowlist": [
    "string"
  ],
  "credential": {
    "authMethod": "basic",
    "basic": {
      "username": "string"
    }
  },
  "createdBy": "string",
  "updatedBy": "string",
  "createdAt": "2024-01-15T09:30:00Z",
  "updatedAt": "2024-01-15T09:30:00Z",
  "description": "string"
}
```

**SDK Code**

```python
import requests

url = "https://api.sigmacomputing.com/v2/api-credentials"

payload = {
    "name": "string",
    "allowlist": ["string"],
    "credential": {
        "authMethod": "basic",
        "basic": {
            "password": "string",
            "username": "string"
        }
    }
}
headers = {
    "Authorization": "<token>.",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.sigmacomputing.com/v2/api-credentials';
const options = {
  method: 'POST',
  headers: {Authorization: '<token>.', 'Content-Type': 'application/json'},
  body: '{"name":"string","allowlist":["string"],"credential":{"authMethod":"basic","basic":{"password":"string","username":"string"}}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sigmacomputing.com/v2/api-credentials"

	payload := strings.NewReader("{\n  \"name\": \"string\",\n  \"allowlist\": [\n    \"string\"\n  ],\n  \"credential\": {\n    \"authMethod\": \"basic\",\n    \"basic\": {\n      \"password\": \"string\",\n      \"username\": \"string\"\n    }\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<token>.")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.sigmacomputing.com/v2/api-credentials")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<token>.'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"string\",\n  \"allowlist\": [\n    \"string\"\n  ],\n  \"credential\": {\n    \"authMethod\": \"basic\",\n    \"basic\": {\n      \"password\": \"string\",\n      \"username\": \"string\"\n    }\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.sigmacomputing.com/v2/api-credentials")
  .header("Authorization", "<token>.")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"string\",\n  \"allowlist\": [\n    \"string\"\n  ],\n  \"credential\": {\n    \"authMethod\": \"basic\",\n    \"basic\": {\n      \"password\": \"string\",\n      \"username\": \"string\"\n    }\n  }\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.sigmacomputing.com/v2/api-credentials', [
  'body' => '{
  "name": "string",
  "allowlist": [
    "string"
  ],
  "credential": {
    "authMethod": "basic",
    "basic": {
      "password": "string",
      "username": "string"
    }
  }
}',
  'headers' => [
    'Authorization' => '<token>.',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.sigmacomputing.com/v2/api-credentials");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "<token>.");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"name\": \"string\",\n  \"allowlist\": [\n    \"string\"\n  ],\n  \"credential\": {\n    \"authMethod\": \"basic\",\n    \"basic\": {\n      \"password\": \"string\",\n      \"username\": \"string\"\n    }\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Authorization": "<token>.",
  "Content-Type": "application/json"
]
let parameters = [
  "name": "string",
  "allowlist": ["string"],
  "credential": [
    "authMethod": "basic",
    "basic": [
      "password": "string",
      "username": "string"
    ]
  ]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.sigmacomputing.com/v2/api-credentials")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```