> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dfns.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Service Account Credential

> Add a new Key credential to the OIDC service account authenticated by this request. The caller must be an OIDC service account — the IdP access token identifies the SA; the user-action is signed with an existing active credential to prove rotation authority.

#### Authentication

❌ Organization User (`CustomerEmployee`)\
❌ Delegated User (`EndUser`)\
✅ Service Account

#### Required Permissions

No permission required.


## OpenAPI

````yaml /openapi.yaml post /auth/service-accounts/credentials
openapi: 3.1.0
info:
  version: 2.0.249
  title: Dfns
servers:
  - url: https://api.dfns.io
    description: Default - Europe
  - url: https://api.uae.dfns.io
    description: UAE
  - url: https://api.dfns.ninja
    description: <Deprecated> Staging
security: []
paths:
  /auth/service-accounts/credentials:
    post:
      tags:
        - Auth
      summary: Create Service Account Credential
      description: >-
        Add a new Key credential to the OIDC service account authenticated by
        this request. The caller must be an OIDC service account — the IdP
        access token identifies the SA; the user-action is signed with an
        existing active credential to prove rotation authority.
      operationId: createServiceAccountCredential
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                publicKey:
                  type: string
                  pattern: >-
                    ^-----BEGIN (RSA )?PUBLIC
                    KEY-----[A-Za-z0-9+/=\n\r\\]+-----END (RSA )?PUBLIC
                    KEY-----\s?$
                name:
                  type: string
                  minLength: 1
                  description: Human-readable name of the credential.
              required:
                - publicKey
              additionalProperties: false
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Credential'
      security:
        - authenticationToken: []
          userActionSignature: []
components:
  schemas:
    Credential:
      type: object
      properties:
        kind:
          type: string
          enum:
            - Fido2
            - Key
            - Password
            - PasswordProtectedKey
            - RecoveryKey
            - SessionKey
            - Totp
        credentialId:
          type: string
          description: Credential ID from the WebAuthn authenticator (base64url).
        credentialUuid:
          type: string
          description: Dfns-internal UUID of the credential.
        dateCreated:
          type: string
          format: date-time
          description: >-
            [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date (must be
            UTC). Date the credential was created.
          example: '2023-04-14T20:41:28.715Z'
        isActive:
          type: boolean
          description: Whether the credential is active.
        name:
          type: string
          description: Human-readable name of the credential.
        publicKey:
          type: string
          description: Public key of the credential.
        relyingPartyId:
          type: string
          description: Relying party identifier associated with the credential.
        origin:
          type: string
          description: Origin where the credential was created.
      required:
        - kind
        - credentialId
        - credentialUuid
        - dateCreated
        - isActive
        - name
        - publicKey
        - relyingPartyId
        - origin
  securitySchemes:
    authenticationToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        **Bearer Token:** Used to authenticate API requests.

        More details how to generate the token: [Authentication
        flows](https://docs.dfns.co/api-reference/auth/login-flows)
    userActionSignature:
      type: apiKey
      in: header
      name: X-DFNS-USERACTION
      description: >-
        **User Action Signature:** Used to sign the change-inducing API
        requests.

        More details how to generate the token: [User Action Signing
        flows](https://docs.dfns.co/api-reference/auth/signing-flows)

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.