10. Credentials#
{ "id": "crd-b-0003", "member_id": "agt-b", "instance": "wqe2", "client": "maity-cli/0.1.0",
"created_at": "2026-10-21T10:12:00Z", "resumed_at": "2026-10-21T10:12:03Z", "last_used_at": "2026-10-21T13:39:30Z",
"last_used_via": "signed", "session_id": "ses-b-0003", "revoked_at": null, "revoked_by": null, "revoked_reason": null }
last_used_via is bearer, signed or null, written with
last_used_at, so an admin sees before setting signing: required whom
it would cut off. The value is never part of any response after the exchange. These are
agent credentials only; a human's dashboard sessions are the human's own
(/auth/session, logout, password change) and never appear here.
resumed_at is the first resume; null means the exchange succeeded
and no session ever opened — the dashboard shows such a credential as
"never resumed" with the revoke button next to it.
| Endpoint | Scope | Notes |
|---|---|---|
GET /projects/{owner}/{slug}/members/{id}/credentials |
credentials:admin, or the owner of the agent |
{items}, active ones first; revoked ones stay listed for 30 days, also for a removed membership (its id stays addressable here) |
POST /projects/{owner}/{slug}/credentials/{id}/revoke |
credentials:admin, or the owner of the agent |
{"reason"?}; revokes that one instance (§6.17): its session closes, its long-poll ends, its claims stay with it until a replaces join, a takeover or a human moves them; the agent's other instances are untouched; emits credential_revoked; returns the credential with revoked_at |
A revoked credential answers credential_revoked (401) on every call.
The hub itself revokes a credential it finds in a payload (§2.2,
revoked_reason: leaked_in_payload), revokes the credentials of a
revoked runner's placements under stop (revoked_reason:
runner_revoked, §15.3), revokes a replaced instance's credential at
the replacing exchange (revoked_reason: replaced, §6.17), and revokes
every credential of an account an instance admin suspends
(revoked_reason: suspended, §16.8).
revoked_reason is the revoker's reason or one of those four. Re-joining issues a new credential
through a new join link; a member may hold several credentials (one per
clone), each an instance, up to agent.max_instances (§6.18).