Skip to content

ModelCredentialOAuth

A coding agent’s subscription sign-in held by an OAuth credential (CredentialKind.OAuth): Claude Code’s or Codex’s. Code pipelines run their agents on it in place of an API key; nothing else can use it. The tokens are write-only and stored protected; the platform keeps the access token fresh with the refresh token.

Kind: an object, used in responses.

Every field is present in a response; empty ones are null.

FieldTypeDescription
toolCredentialOAuthTool
expiresAtUtcdatetimeWhen the access token expires.
scopesstring[]
subscriptionTypestring | nullThe subscription the sign-in belongs to, as the provider names it (for example max or pro).
accountNamestring | nullWho signed in, as the provider shows it (an email address), when it says.
signedInAtUtcdatetime
refreshedAtUtcdatetime | null
nextRefreshAtUtcdatetime | nullWhen the platform next refreshes the tokens: halfway through the access token’s remaining life, or at once when under half an hour is left. Null once a refresh was refused, until the person signs in again.
refreshedByCallerboolean | nullTrue: the tokens were brought with POST /credentials/sign-in-tokens, and whoever brought them keeps them fresh and replaces them with PUT /credentials/by-id/{id}/sign-in-tokens. The platform never refreshes them (ModelCredentialOAuth.NextRefreshAtUtc stays null). Null or false: a sign-in made here, which the platform refreshes.
refreshFailuresintegerRefreshes that failed in a row. Reset by one that succeeds.
lastRefreshErrorstring | nullA stable code for why the last refresh failed.
{
"tool": "Claude",
"expiresAtUtc": "2026-10-26T12:00:00.0000000Z",
"scopes": [
"..."
],
"subscriptionType": "...",
"accountName": "...",
"signedInAtUtc": "2026-10-26T12:00:00.0000000Z",
"refreshedAtUtc": "2026-10-26T12:00:00.0000000Z",
"nextRefreshAtUtc": "2026-10-26T12:00:00.0000000Z",
"refreshedByCaller": false,
"refreshFailures": 0,
"lastRefreshError": "..."
}