ModelCredentialOAuth
A coding agent’s subscription sign-in held by an OAuth credential (CredentialKind.OAuth): Claude Code’s or Codex’s. Code pipelines run their agents on it in place of an API key; nothing else can use it. The tokens are write-only and stored protected; the platform keeps the access token fresh with the refresh token.
Kind: an object, used in responses.
Fields
Section titled “Fields”Every field is present in a response; empty ones are null.
| Field | Type | Description |
|---|---|---|
tool | CredentialOAuthTool | |
expiresAtUtc | datetime | When the access token expires. |
scopes | string[] | |
subscriptionType | string | null | The subscription the sign-in belongs to, as the provider names it (for example max or pro). |
accountName | string | null | Who signed in, as the provider shows it (an email address), when it says. |
signedInAtUtc | datetime | |
refreshedAtUtc | datetime | null | |
nextRefreshAtUtc | datetime | null | When the platform next refreshes the tokens: halfway through the access token’s remaining life, or at once when under half an hour is left. Null once a refresh was refused, until the person signs in again. |
refreshedByCaller | boolean | null | True: the tokens were brought with POST /credentials/sign-in-tokens, and whoever brought them keeps them fresh and replaces them with PUT /credentials/by-id/{id}/sign-in-tokens. The platform never refreshes them (ModelCredentialOAuth.NextRefreshAtUtc stays null). Null or false: a sign-in made here, which the platform refreshes. |
refreshFailures | integer | Refreshes that failed in a row. Reset by one that succeeds. |
lastRefreshError | string | null | A stable code for why the last refresh failed. |
Example
Section titled “Example”{ "tool": "Claude", "expiresAtUtc": "2026-10-26T12:00:00.0000000Z", "scopes": [ "..." ], "subscriptionType": "...", "accountName": "...", "signedInAtUtc": "2026-10-26T12:00:00.0000000Z", "refreshedAtUtc": "2026-10-26T12:00:00.0000000Z", "nextRefreshAtUtc": "2026-10-26T12:00:00.0000000Z", "refreshedByCaller": false, "refreshFailures": 0, "lastRefreshError": "..."}Where it’s used
Section titled “Where it’s used”- Inside
ModelCredential