CredentialSignInTokensRequest

A subscription sign-in’s tokens that you already hold, made into an OAuth credential (or replacing the tokens of one made that way). By default you keep them fresh: the platform never refreshes them, and you send new ones each time you refresh. With keepFresh, the platform takes that over. The name, description and tag are the new credential’s; replacing tokens keeps the credential’s own.

Kind: an object, used in requests.

Fields

Field	Type	Description
`tool`	`CredentialOAuthTool`	The coding agent the sign-in is for.
`accessToken`	`string`	The access token. Write-only.
`refreshToken`	`string`	The refresh token, which the coding agent may need during a long run. Write-only.
`idToken`	`string \| null`	The OpenID Connect ID token. Required for Codex; null for Claude. Write-only.
`expiresAtUtc`	`datetime`	When the access token expires (UTC).
`scopes`	`string[] \| null`	The scopes the tokens carry.
`subscriptionType`	`string \| null`	The subscription the sign-in belongs to, as the provider names it (for example `max`).
`accountName`	`string \| null`	Who signed in, as the provider shows it.
`name`	`string \| null`
`description`	`string \| null`
`tag`	`string \| null`
`keepFresh`	`boolean`	True: the platform keeps these tokens fresh from now on, with the refresh token, as it does for a sign-in made here. Stop refreshing them yourself: a refresh replaces the refresh token, so only one side can keep doing it. Replacing the tokens of a sign-in you’ve been refreshing with this set hands it over. Once handed over it can’t be handed back; sign in again for new tokens. False (default): you keep them fresh.

Example

{
  "tool": "Claude",
  "accessToken": "...",
  "refreshToken": "...",
  "idToken": "...",
  "expiresAtUtc": "2026-10-26T12:00:00.0000000Z",
  "scopes": [
    "..."
  ],
  "subscriptionType": "...",
  "accountName": "...",
  "name": "...",
  "description": "...",
  "tag": "...",
  "keepFresh": false
}

Where it’s used

credentials.importSignIn (POST /credentials/sign-in-tokens)
credentials.replaceSignInTokens (PUT /credentials/by-id/{id}/sign-in-tokens)