Kernel Credential Providers API
Configure external credential providers like 1Password.
OpenAPI Specification
openapi: 3.1.0
info:
title: Kernel API Keys Credential Providers API
description: Developer tools and cloud infrastructure for AI agents to use web browsers
version: 0.1.0
servers:
- url: https://api.onkernel.com
description: API Server
security:
- bearerAuth: []
tags:
- name: Credential Providers
description: Configure external credential providers like 1Password.
paths:
/org/credential_providers:
post:
x-hidden: true
operationId: postCredentialProviders
tags:
- Credential Providers
summary: Create a credential provider
description: Configure an external credential provider (e.g., 1Password) for automatic credential lookup.
security:
- bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateCredentialProviderRequest'
responses:
'201':
description: Credential provider created successfully
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialProvider'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'409':
$ref: '#/components/responses/Conflict'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.create({\n token: 'ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',\n name: 'my-1password',\n provider_type: 'onepassword',\n});\n\nconsole.log(credentialProvider.id);"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.create(\n token=\"ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n name=\"my-1password\",\n provider_type=\"onepassword\",\n)\nprint(credential_provider.id)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.New(context.TODO(), kernel.CredentialProviderNewParams{\n\t\tCreateCredentialProviderRequest: kernel.CreateCredentialProviderRequestParam{\n\t\t\tToken: \"ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n\t\t\tName: \"my-1password\",\n\t\t\tProviderType: kernel.CreateCredentialProviderRequestProviderTypeOnepassword,\n\t\t},\n\t})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
get:
x-hidden: true
operationId: getCredentialProviders
tags:
- Credential Providers
summary: List credential providers
description: List external credential providers configured for the organization.
security:
- bearerAuth: []
parameters:
- name: limit
in: query
required: false
description: Limit the number of credential providers to return.
schema:
type: integer
minimum: 1
maximum: 100
default: 20
- name: offset
in: query
required: false
description: Offset the number of credential providers to return.
schema:
type: integer
minimum: 0
default: 0
- name: query
in: query
required: false
description: Case-insensitive substring match against credential provider name. IDs match by exact value.
schema:
type: string
responses:
'200':
description: List of credential providers
headers:
X-Limit:
description: Limit the number of credential providers to return.
schema:
type: integer
minimum: 1
maximum: 100
default: 20
X-Offset:
description: The offset of credential providers to return.
schema:
type: integer
minimum: 0
default: 0
X-Next-Offset:
description: The offset where the next page starts. 0 when there are no more results.
schema:
type: integer
nullable: true
X-Has-More:
description: Whether there are more credential providers to fetch.
schema:
type: boolean
default: false
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/CredentialProvider'
'401':
$ref: '#/components/responses/Unauthorized'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\n// Automatically fetches more pages as needed.\nfor await (const credentialProvider of client.credentialProviders.list()) {\n console.log(credentialProvider.id);\n}"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\npage = client.credential_providers.list()\npage = page.items[0]\nprint(page.id)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tpage, err := client.CredentialProviders.List(context.TODO(), kernel.CredentialProviderListParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", page)\n}\n"
/org/credential_providers/{id}:
get:
x-hidden: true
operationId: getCredentialProvidersById
tags:
- Credential Providers
summary: Get credential provider by ID
description: Retrieve a credential provider by its ID.
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Credential provider ID
responses:
'200':
description: Credential provider details
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialProvider'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.retrieve('id');\n\nconsole.log(credentialProvider.id);"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.retrieve(\n \"id\",\n)\nprint(credential_provider.id)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.Get(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
patch:
x-hidden: true
operationId: patchCredentialProvidersById
tags:
- Credential Providers
summary: Update credential provider
description: Update a credential provider's configuration.
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Credential provider ID
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateCredentialProviderRequest'
responses:
'200':
description: Credential provider updated successfully
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialProvider'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'409':
$ref: '#/components/responses/Conflict'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.update('id');\n\nconsole.log(credentialProvider.id);"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.update(\n id=\"id\",\n)\nprint(credential_provider.id)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.Update(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.CredentialProviderUpdateParams{\n\t\t\tUpdateCredentialProviderRequest: kernel.UpdateCredentialProviderRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
delete:
x-hidden: true
operationId: deleteCredentialProvidersById
tags:
- Credential Providers
summary: Delete credential provider
description: Delete a credential provider by its ID.
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Credential provider ID
responses:
'204':
description: Credential provider deleted successfully
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nawait client.credentialProviders.delete('id');"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\nclient.credential_providers.delete(\n \"id\",\n)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\terr := client.CredentialProviders.Delete(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
/org/credential_providers/{id}/test:
post:
x-hidden: true
operationId: testCredentialProviderById
tags:
- Credential Providers
summary: Test credential provider connection
description: Validate the credential provider's token and list accessible vaults.
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Credential provider ID
responses:
'200':
description: Connection test successful
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialProviderTestResult'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProviderTestResult = await client.credentialProviders.test('id');\n\nconsole.log(credentialProviderTestResult.success);"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\ncredential_provider_test_result = client.credential_providers.test(\n \"id\",\n)\nprint(credential_provider_test_result.success)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProviderTestResult, err := client.CredentialProviders.Test(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProviderTestResult.Success)\n}\n"
/org/credential_providers/{id}/items:
get:
x-hidden: true
operationId: getCredentialProviderItems
tags:
- Credential Providers
summary: List items from a credential provider
description: Returns available credential items (e.g., 1Password login items) from the provider.
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Credential provider ID
responses:
'200':
description: List of credential items
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/CredentialProviderItem'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalError'
x-codeSamples:
- lang: JavaScript
source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst response = await client.credentialProviders.listItems('id');\n\nconsole.log(response.items);"
- lang: Python
source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n api_key=os.environ.get(\"KERNEL_API_KEY\"), # This is the default and can be omitted\n)\nresponse = client.credential_providers.list_items(\n \"id\",\n)\nprint(response.items)"
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tresponse, err := client.CredentialProviders.ListItems(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", response.Items)\n}\n"
components:
responses:
Conflict:
description: Conflict – resource already exists
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
InternalError:
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Unauthorized:
description: Unauthorized – missing or invalid authorization token
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
BadRequest:
description: Bad Request – invalid input
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
NotFound:
description: Resource not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Forbidden:
description: Forbidden – insufficient permissions or plan
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
schemas:
CredentialProviderItem:
type: object
description: A credential item from an external provider (e.g., a 1Password login item)
required:
- id
- title
- vault_id
- vault_name
- path
properties:
id:
type: string
description: Unique identifier for the item within the provider
example: abc123xyz
title:
type: string
description: Display name of the credential item
example: Netflix Login
vault_id:
type: string
description: ID of the vault containing this item
example: vault_abc123
vault_name:
type: string
description: Name of the vault containing this item
example: Engineering
path:
type: string
description: Path to reference this item (VaultName/ItemTitle format)
example: Engineering/Netflix Login
urls:
type: array
items:
type: string
description: URLs associated with this credential
example:
- https://netflix.com
- https://www.netflix.com
additionalProperties: false
Error:
type: object
required:
- code
- message
properties:
code:
type: string
description: Application-specific error code (machine-readable)
example: bad_request
message:
type: string
description: Human-readable error description for debugging
example: 'Missing required field: app_name'
details:
type: array
description: Additional error details (for multiple errors)
items:
$ref: '#/components/schemas/ErrorDetail'
inner_error:
$ref: '#/components/schemas/ErrorDetail'
CredentialProvider:
type: object
description: An external credential provider (e.g., 1Password) for automatic credential lookup
required:
- id
- provider_type
- name
- enabled
- priority
- created_at
- updated_at
properties:
id:
type: string
description: Unique identifier for the credential provider
example: credprov_abc123xyz
provider_type:
type: string
description: Type of credential provider
enum:
- onepassword
example: onepassword
name:
type: string
description: Human-readable name for this provider instance
example: my-1password
enabled:
type: boolean
description: Whether the provider is enabled for credential lookups
example: true
priority:
type: integer
description: Priority order for credential lookups (lower numbers are checked first)
example: 0
created_at:
type: string
format: date-time
description: When the credential provider was created
example: '2025-01-15T10:30:00Z'
updated_at:
type: string
format: date-time
description: When the credential provider was last updated
example: '2025-01-15T10:30:00Z'
additionalProperties: false
CreateCredentialProviderRequest:
type: object
description: Request to create an external credential provider
required:
- provider_type
- name
- token
properties:
provider_type:
type: string
description: Type of credential provider
enum:
- onepassword
example: onepassword
name:
type: string
description: Human-readable name for this provider instance (unique per org)
example: my-1password
token:
type: string
description: Service account token for the provider (e.g., 1Password service account token)
example: ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
cache_ttl_seconds:
type: integer
description: How long to cache credential lists (default 300 seconds)
default: 300
example: 300
additionalProperties: false
CredentialProviderTestResult:
type: object
description: Result of testing a credential provider connection
required:
- success
- vaults
properties:
success:
type: boolean
description: Whether the connection test was successful
example: true
vaults:
type: array
description: List of vaults accessible by the service account
items:
type: object
required:
- id
- name
properties:
id:
type: string
description: Vault ID
example: abc123xyz
name:
type: string
description: Vault name
example: Shared Logins
error:
type: string
description: Error message if the test failed
example: Invalid token
additionalProperties: false
UpdateCredentialProviderRequest:
type: object
description: Request to update a credential provider
properties:
name:
type: string
description: Human-readable name for this provider instance
example: my-1password
enabled:
type: boolean
description: Whether the provider is enabled for credential lookups
example: true
priority:
type: integer
description: Priority order for credential lookups (lower numbers are checked first)
example: 0
token:
type: string
description: New service account token (to rotate credentials)
example: ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
cache_ttl_seconds:
type: integer
description: How long to cache credential lists
example: 300
additionalProperties: false
ErrorDetail:
type: object
properties:
code:
type: string
description: Lower-level error code providing more specific detail
example: invalid_input
message:
type: string
description: Further detail about the error
example: Provided version string is not semver compliant
securitySchemes:
bearerAuth:
type: http
scheme: bearer