# CodePipelineOAuthCredentials

A coding tool's sign-in (OAuth tokens from a subscription) for a code pipeline engine, used in place of an API key.

**Kind:** an object, used in requests and responses. In a request it is called `CodePipelineOAuthCredentialsInput`.

## In a request

| Field | Type | Required | Description |
|---|---|---|---|
| `accessToken` | `string` |  | The OAuth access token. Write-only: never returned. |
| `refreshToken` | `string` |  | The OAuth refresh token. Write-only: never returned. |
| `idToken` | `string \| null` |  | The OpenID Connect ID token, for coding tools that need it alongside the access and refresh tokens (Codex does; Claude Code doesn't). Write-only: never returned. |
| `expiresAt` | `datetime` |  | When the access token expires, in UTC. |
| `scopes` | `string[] \| null` |  | The scopes the tokens were granted. |
| `oAuthSubscriptionType` | `string \| null` |  | The subscription plan the sign-in belongs to (for example a Claude subscription tier), as the provider names it. |
| `engine` | [`CodeEngineType`](https://docs.maitento.com/reference/types/code-engine-type.md) |  | The engine this credential is for. |
| `credentialId` | `string \| null` |  | Your id for this credential. The run records it on the tokens the credential used (`tokenUsage`) and, when your own credential fails, in `credentialFailures`, so you can tell which key did what. |
| `isOwnLicense` | `boolean` |  | True for your own key or sign-in, which you pay the provider for. False marks a fallback to Maitento's own key: leave its `apiKey` empty. Its use counts as platform usage, and your tenant can forbid it. |
| `priority` | `integer \| null` |  | The order to try this engine's credentials in: lower first. Null: after the numbered ones. |
| `billingMode` | `string \| null` |  | The kind of plan the credential is on with its provider (for example `SubscriptionPlan` or `PayAsYouGoApi`), recorded for reporting. Null when not given. |

```json
{
  "accessToken": "...",
  "refreshToken": "...",
  "idToken": "...",
  "expiresAt": "2026-10-26T12:00:00.0000000Z",
  "scopes": [
    "..."
  ],
  "oAuthSubscriptionType": "...",
  "engine": "Claude",
  "credentialId": "...",
  "isOwnLicense": false,
  "priority": 0,
  "billingMode": "..."
}
```

## In a response

Every field is present in a response; empty ones are `null`.

| Field | Type | Description |
|---|---|---|
| `expiresAt` | `datetime` | When the access token expires, in UTC. |
| `scopes` | `string[] \| null` | The scopes the tokens were granted. |
| `oAuthSubscriptionType` | `string \| null` | The subscription plan the sign-in belongs to (for example a Claude subscription tier), as the provider names it. |
| `engine` | [`CodeEngineType`](https://docs.maitento.com/reference/types/code-engine-type.md) | The engine this credential is for. |
| `credentialId` | `string \| null` | Your id for this credential. The run records it on the tokens the credential used (`tokenUsage`) and, when your own credential fails, in `credentialFailures`, so you can tell which key did what. |
| `isOwnLicense` | `boolean` | True for your own key or sign-in, which you pay the provider for. False marks a fallback to Maitento's own key: leave its `apiKey` empty. Its use counts as platform usage, and your tenant can forbid it. |
| `priority` | `integer \| null` | The order to try this engine's credentials in: lower first. Null: after the numbered ones. |
| `billingMode` | `string \| null` | The kind of plan the credential is on with its provider (for example `SubscriptionPlan` or `PayAsYouGoApi`), recorded for reporting. Null when not given. |

```json
{
  "expiresAt": "2026-10-26T12:00:00.0000000Z",
  "scopes": [
    "..."
  ],
  "oAuthSubscriptionType": "...",
  "engine": "Claude",
  "credentialId": "...",
  "isOwnLicense": false,
  "priority": 0,
  "billingMode": "..."
}
```

## Where it's used

- Inside [`CodePipelineProcessCredentials`](https://docs.maitento.com/reference/types/code-pipeline-process-credentials.md)