# ModelCredentialOAuth

A coding agent's subscription sign-in held by an OAuth credential (`CredentialKind.OAuth`): Claude Code's or Codex's. Code pipelines run their agents on it in place of an API key; nothing else can use it. The tokens are write-only and stored protected; the platform keeps the access token fresh with the refresh token.

**Kind:** an object, used in responses.

## Fields

Every field is present in a response; empty ones are `null`.

| Field | Type | Description |
|---|---|---|
| `tool` | [`CredentialOAuthTool`](https://docs.maitento.com/reference/types/credential-o-auth-tool.md) |  |
| `expiresAtUtc` | `datetime` | When the access token expires. |
| `scopes` | `string[]` |  |
| `subscriptionType` | `string \| null` | The subscription the sign-in belongs to, as the provider names it (for example `max` or `pro`). |
| `accountName` | `string \| null` | Who signed in, as the provider shows it (an email address), when it says. |
| `signedInAtUtc` | `datetime` |  |
| `refreshedAtUtc` | `datetime \| null` |  |
| `nextRefreshAtUtc` | `datetime \| null` | When the platform next refreshes the tokens: halfway through the access token's remaining life, or at once when under half an hour is left. Null once a refresh was refused, until the person signs in again. |
| `refreshedByCaller` | `boolean \| null` | True: the tokens were brought with `POST /credentials/sign-in-tokens`, and whoever brought them keeps them fresh and replaces them with `PUT /credentials/by-id/{id}/sign-in-tokens`. The platform never refreshes them (`ModelCredentialOAuth.NextRefreshAtUtc` stays null). Null or false: a sign-in made here, which the platform refreshes. |
| `refreshFailures` | `integer` | Refreshes that failed in a row. Reset by one that succeeds. |
| `lastRefreshError` | `string \| null` | A stable code for why the last refresh failed. |

## Example

```json
{
  "tool": "Claude",
  "expiresAtUtc": "2026-10-26T12:00:00.0000000Z",
  "scopes": [
    "..."
  ],
  "subscriptionType": "...",
  "accountName": "...",
  "signedInAtUtc": "2026-10-26T12:00:00.0000000Z",
  "refreshedAtUtc": "2026-10-26T12:00:00.0000000Z",
  "nextRefreshAtUtc": "2026-10-26T12:00:00.0000000Z",
  "refreshedByCaller": false,
  "refreshFailures": 0,
  "lastRefreshError": "..."
}
```

## Where it's used

- Inside [`ModelCredential`](https://docs.maitento.com/reference/types/model-credential.md)