> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blobhub.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Credential

Create a new credential for a target.

## **POST** `/credentials/target/:target/:target_id`

### Path Parameters

| Parameter   | Type   | Required | Description                              |
| :---------- | :----- | :------- | :--------------------------------------- |
| `target`    | string | Yes      | Resource type: `org`, `blob`, or `user`. |
| `target_id` | string | Yes      | The unique ID of the target resource.    |

### Request Body

| Parameter     | Type   | Required | Description                             |
| :------------ | :----- | :------- | :-------------------------------------- |
| `alias`       | string | Yes      | Unique alias for the credential.        |
| `type`        | string | Yes      | Credential provider type (e.g., `aws`). |
| `body`        | object | Yes      | Provider-specific credential details.   |
| `description` | string | No       | Description of the credential.          |

### Response

| Parameter       | Type   | Description                      |
| :-------------- | :----- | :------------------------------- |
| `credential_id` | string | The unique ID of the credential. |

### Errors

| Status | Error       | Cause                                                                 |
| :----- | :---------- | :-------------------------------------------------------------------- |
| 403    | `forbidden` | Missing `admin` access to the target, or no human behind the request. |

Storing a credential hands the target the keys to some other system entirely, so it is a human act: a
[service account](/general/service-accounts)'s own key gets `403` for every target, even one it otherwise
administers with `admin`. Use an [acting token](/rest-api/auth/impersonate) when automation has to store one
on a human's behalf.

<Note>
  `target=user/{account}` stores the credential **on** a service account. Those are the credentials retirement
  deletes — see [Delete User](/rest-api/users/delete-user).
</Note>

### Example

<CodeGroup>
  ```json Request theme={null}
  {
    "alias": "aws-dev",
    "type": "aws",
    "body": {
      "access_key_id": "AKIA...",
      "secret_access_key": "secret..."
    }
  }
  ```

  ```json Response theme={null}
  {
    "status": "success",
    "credential_id": "cred_002"
  }
  ```
</CodeGroup>