Create a credential binding

Connect an authorized identity and target to a secret reference.

Before you start

Have a registered target, the intended credential mode, a secret reference, and permission to manage bindings.

Procedure

1. Open credential bindings and create a binding for the intended subject and target.

2. Choose the mode that matches the authority: service account, delegated user, agent-scoped, or workload-mapped.

3. Enter the supported secret reference and validate the binding. Keep raw secret material out of the definition.

4. Enable the binding through its supported lifecycle and verify the runtime accepts the new configuration.

Verify the result

Invoke a permitted tool and check the audit credential mode. Verify an unrelated agent cannot use the binding.

If it does not work

A missing, revoked, or incompatible binding must deny execution. Check subject, target, scope, and secret-backend access before rotating credentials.

Read the related concept or consult the Admin API for exact request fields.

Implementation reference

Read the source contract.