List AI credentials
Returns all AI provider credentials registered by the authenticated user. The API key itself is never returned — only the provider name, optional base URL, and timestamps. Use this to check which providers are configured before calling Magic Dust analysis. **Required scope:** `ai:read`
Authorization
BearerAuth Security scheme for OpenAPI endpoints. Validates both JWT tokens and API keys.
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/ai/credentials"{ "credentials": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "provider": "claude", "base_url": "string", "created_at": "string", "updated_at": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}OAuth provider redirect callback.
Called by the IdP (Azure AAD, Google) after the user consents at their authorize URL. Consumes the one-time `state`, exchanges the `code` for tokens (persisting the refresh token to the vault + cache), then upserts `user_provider_identity_linking` with the IdP subject claim. Response body depends on whether the state row had a `return_to`: - Set: 302 to that URL with `?status=success` (used by CLI static page). - Unset: 200 with HTML that `postMessage`s the popup opener and closes.
Upsert an AI credential
Creates or replaces the API key for the specified AI provider. If a credential for the same provider already exists, it is overwritten. The stored key is encrypted at rest and is never returned by any GET endpoint. **Required scope:** `ai:write`