Request

Method and path	GET`/v1/credentials/{name}`
Base URL	`https://api.boxline.dev`
Authentication	Your API key in the `x-api-key` header (or `Authorization: Bearer`). The examples read it from `BOXLINE_API_KEY`.

Path parameters

Name	Type	Default	Allowed values	Description
`name`required	`string`	–	–	Up to 64 characters. Pattern: `^[A-Z_][A-Z0-9_]*$`.

curl "https://api.boxline.dev/v1/credentials/$CREDENTIAL_NAME" \  -H "x-api-key: $BOXLINE_API_KEY"

import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLconst credential = await bx.credentials.get("SHOP");console.log(credential.type, credential.scope, credential.origins, credential.lastUsedAt); // never a value

from boxline import Boxlinebx = Boxline()  # reads BOXLINE_API_KEY and BOXLINE_API_URLcredential = bx.credentials.get("SHOP")print(credential["type"], credential["scope"], credential["origins"], credential["lastUsedAt"])  # never a value

Responses

200 OK

The credential.

Fields

Name	Type	Default	Allowed values	Description
`name`	`string`	–	–
`type`	`string`	–	`password`, `secret`
`description`	`string \| null`	–	–
`origins`	`string[] \| null`	–	–	Sites where the AI may type it (null = any site; always set for a password).
`username`	`string`	–	–	A password's user name.
`hasTotp`	`boolean`	–	–	A password has a 2FA key (codeSource totp).
`codeSource`	`string \| null`	–	`totp`, `push`, `url`, `null`	Where a password's 2FA codes come from (%NAME.otp%, boxline-otp NAME); null: no 2FA.
`codeUrl`	`string \| null`	–	–	The endpoint the platform asks for codes (codeSource url).
`codeTimeoutSeconds`	`integer`	–	–	How long a wait for a pushed or asked code lasts. From 5 to 900.
`preview`	`string \| null`	–	–	A secret's last 4 characters, for values of 24 characters or more; null for shorter values and for secrets with origins.
`shell`	`boolean`	–	–	The AI may use it in bash commands; this also allows exporting it into shells.
`scope`	`string`	`agent`	`agent`, `shell`, `all`	agent: only the AI, as placeholders (agent runs, steps, scripts' step(), the type action); shell: only as environment variables in session shells and commands; all: both.
`createdAt`	`string`	–	–	Format: date-time.
`updatedAt`	`string`	–	–	Format: date-time.
`lastUsedAt`	`string \| null`	–	–	Format: date-time.

Response 200

{  "name": "SHOP",  "type": "password",  "description": "…",  "origins": [    "…"  ],  "username": "…",  "hasTotp": false,  "codeSource": "totp",  "codeUrl": "…",  "codeTimeoutSeconds": 5,  "preview": "••••1a2b",  "shell": false,  "scope": "agent",  "createdAt": "2026-09-29T10:00:00.000Z",  "updatedAt": "2026-09-29T10:00:00.000Z",  "lastUsedAt": "2026-09-29T10:00:00.000Z"}

Errors

Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.

Status	Codes	When
400 Bad Request	`invalid_request`, `invalid_json`, `invalid_cursor`, `invalid_idempotency_key`, `invalid_extension`, `variables_with_extensions`, `terms_not_accepted`, `invalid_reset_token`, `invalid_confirmation_code`, `wrong_password`, `no_password`, `invalid_next`, `invalid_oauth_token`	The request is not valid.
401 Unauthorized	`unauthorized`	Missing or invalid API key.
404 Not Found	`not_found`, `invite_not_found`, `provider_unavailable`	No such thing in this project (or organization), or no such route.

Error body

{  "error": {    "code": "not_found",    "message": "session not found",    "requestId": "req_4fJx0aQm2Lk9Pz7N"  }}

Learn more

CredentialsThe guide to this part of the API, with more examples.

These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.