Skip to main content

​
/api/provider-credentials

Supports GET, POST, and DELETE for provider credential state.

​
GET

Returns normalized connection list for all supported providers.

​
POST

Stores encrypted provider secret. Request body: 
{
  "provider": "openai",
  "authType": "apiKey",
  "secret": "sk-...",
  "displayName": "optional"
}

​
DELETE

Removes provider credential for current authenticated user. Request body: 
{
  "provider": "openai"
}

​
Security

  • Same-origin required.
  • Auth required.
  • Per-user/provider rate limits on mutation operations.
  • Secrets encrypted before storage.