Create a credential binding
A credential binding ties a secret (referenced in your secret manager, never inlined) to an upstream under one of the credential modes. The broker resolves it at the edge — the secret never reaches the agent or audit.
- Validate the binding (mode, secret reference, scope).
- Create it — it enters approval.
- Rotate / disable / revoke over its lifetime as needed.
Create the binding
Section titled “Create the binding”Create a credential binding
- Open Access → Credential bindings → New.
- Choose the credential mode, point at the secret reference, and set the scope, then Create.
curl -X POST "$GATEWAY/v1/credential-bindings" \
-H "authorization: Bearer $TOKEN" \
-H "content-type: application/json" \
--data '{
"mode": "service_account",
"server_id": "legal-contract-review",
"secret_ref": "vault://kv/data/mcp/legal-sa"
}'createCredentialBinding in the API reference →gatewayctl validate-credential-binding binding.yaml --format jsonValidate with validate-credential-binding; create/update via the API or `gatewayctl credential-binding update`.
Rotate, disable, or revoke
Section titled “Rotate, disable, or revoke”Rotate or revoke a binding
- Open the binding under Access → Credential bindings.
- Use Rotate, Disable, or Revoke — each is recorded as an auditable transition.
curl -X POST \
"$GATEWAY/v1/credential-bindings/cb_123/rotate" \
-H "authorization: Bearer $TOKEN"rotateCredentialBinding in the API reference →gatewayctl credential-binding rotate cb_123 --format jsoncredential-binding supports list / get / update / rotate / disable / revoke / status.
Type set in Geist, Source Serif 4, and Departure Mono.