---
title: "Make a credential for this user (another machine, a cloud sandbox)"
description: "The new credential acts as the same user. Its secret is shown once."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Pando API › users

`POST /v1/user/credentials`

The new credential acts as the same user. Its secret is shown once.

## Authentication

Requires one of the following:

- `credential`, http, header `Authorization`
- `session`, apiKey, in cookie

## Request body

_Required._

- `createCredential.name` (string, required) — The machine or sandbox, for example `ramos-mbp` or `sandbox-agent-3`.
- `createCredential.kind` (string, optional)
  - one of `"machine"`, `"sandbox"`; default `"machine"`

## Example request

```json
{
  "name": "string",
  "kind": "machine"
}
```

## Code samples

### cURL

```curl
curl --request POST \
  --url https://app.gitpando.com/v1/user/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "string",
  "kind": "machine"
}
'
```

### TypeScript

```typescript
const url = 'https://app.gitpando.com/v1/user/credentials';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({name: 'string', kind: 'machine'})
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://app.gitpando.com/v1/user/credentials"

payload = {
    "name": "string",
    "kind": "machine"
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 201

Created

#### Example

```json
{
  "id": "string",
  "name": "string",
  "kind": "machine",
  "created_at": "2019-08-24T14:15:22Z",
  "last_used_at": "2019-08-24T14:15:22Z",
  "expires_at": "2019-08-24T14:15:22Z",
  "secret": "string"
}
```

- `createCredential.response.201.id` (string, required)
- `createCredential.response.201.name` (string, required)
- `createCredential.response.201.kind` (string, required)
  - one of `"machine"`, `"sandbox"`, `"bootstrap"`, `"browser"`
- `createCredential.response.201.created_at` (string, required)
  - format `date-time`
- `createCredential.response.201.secret` (string, required) — `pando_` and 40 hex characters. Shown once; Pando keeps only its SHA-256.
- `createCredential.response.201.last_used_at` (string | null, optional)
  - format `date-time`
- `createCredential.response.201.expires_at` (string | null, optional) — Browser sessions only: the end unless used before then (each use pushes it to 30 days).
  - format `date-time`


Source: https://docs.gitpando.com/api/users/createCredential/index.md