Provider credentials
Store and verify organization-owned registry and DNS credentials.
Provider credentials let Openship pull private images or update DNS. A credential belongs to one organization. Reads expose public fields and masked secret indicators; creating, changing, verifying, or removing a credential requires administration access.
Discover supported providers
Read provider definitions before building a credential form. Each definition includes its ID, capability,
selector requirements, and field keys. Use those keys in the values object when creating a credential.
const providers = await ship.credentials.listProviders();
console.log(providers);curl "$OPENSHIP_URL/api/credentials/providers" \
-H "Authorization: Bearer $OPENSHIP_TOKEN"Create or update a credential
| Field | Type | Use |
|---|---|---|
provider | string | Required on creation; an ID from the provider catalog, at most 64 characters. |
name | string | Required on creation; a display name of 1–100 characters. |
selector | string or null | Provider-specific registry or account selector. |
values | Record<string, string> | Required on creation; public and secret fields defined by the provider. |
Updates accept name, selector, and values. The provider cannot be changed. Use values from your
credential form or secret store; masked values returned by reads are not replacement secrets.
Verify a saved credential
const credential = await ship.credentials.verify("cred_123");
console.log(credential.status, credential.lastError);curl -X POST "$OPENSHIP_URL/api/credentials/cred_123/verify" \
-H "Authorization: Bearer $OPENSHIP_TOKEN"Verification returns the credential's status, lastVerifiedAt, and lastError. Check that status before
using the credential for a deployment. See DNS providers for the DNS connection workflow.
Operations
| Operation | SDK | REST API |
|---|---|---|
| List provider credential types and required fields. | credentials.listProviders() | GET /api/credentials/providerssettings:read |
| List stored credentials with secrets masked. | credentials.list() | GET /api/credentialssettings:read |
| Store a provider credential. | credentials.create(input) | POST /api/credentialssettings:admin |
| Read one masked credential. | credentials.get(id) | GET /api/credentials/:idsettings:read |
| Rename, re-scope, or rotate a credential. | credentials.update(id, input) | PATCH /api/credentials/:idsettings:admin |
| Remove a credential. | credentials.remove(id) | DELETE /api/credentials/:idsettings:admin |
| Check the credential against its provider and record the result. | credentials.verify(id) | POST /api/credentials/:id/verifysettings:admin |