API REFERENCE

The credential vault

A per-user vault for secrets. Store a token once, reference it in tool auth by name, and the raw value never reaches the model.

Every credential endpoint requires signed identity mode. The user_context must be signed, provisioning is server to server. An unsigned or expired identity is rejected with SIGNED_IDENTITY_REQUIRED or IDENTITY_SIGNATURE_EXPIRED.

Store a credential

PUT/v1/credentials

Stores a secret for one user, encrypted at rest with Fernet. PUT is upsert: reusing a name replaces the value. The raw secret is write-only, once stored you can only read a masked hint.

Field	Type	Description
`user_context`required	object	The signed end-user identity the secret belongs to.
`name`required	string	Reference name. Up to 64 chars, [A-Za-z0-9_.-] only.
`value`required	string	The secret. Up to 8 KB.

Caps: 50 credentials per user, 8 KB per value. Exceeding the name rules or caps returns a validation error.

bash

curl -X PUT https://eerraa.online/v1/credentials \
  -H "Authorization: Bearer era_your_project_key" \
  -H "Content-Type: application/json" \
  -d '{
    "user_context": { "id": "u_42", "_ts": 1735689600, "_sig": "..." },
    "name": "github_token",
    "value": "ghp_xxxxxxxxxxxxxxxx"
  }'

Response, the name plus a masked hint (never the value):

json

{ "name": "github_token", "secret_hint": "ghp_...xxxx" }

List and revoke

GET/v1/credentials

Lists the calling user's credentials as masked hints. Pass the signed identity in X-Era-User.

bash

# List one user's masked credentials. Identity in the header on a GET.
curl "https://eerraa.online/v1/credentials" \
  -H "Authorization: Bearer era_your_project_key" \
  -H "X-Era-User: $(python -c 'import json,urllib.parse; print(urllib.parse.quote(json.dumps({"id":"u_42","_ts":1735689600,"_sig":"..."})))')"

Response:

json

{
  "credentials": [
    { "name": "github_token", "secret_hint": "ghp_...xxxx" }
  ]
}

DELETE/v1/credentials/{name}

Revokes one credential by name. Omit the name to clear all of the user's credentials.

bash

curl -X DELETE https://eerraa.online/v1/credentials/github_token \
  -H "Authorization: Bearer era_your_project_key" \
  -H "X-Era-User: %7B%22id%22%3A%22u_42%22%2C%22_ts%22%3A1735689600%2C%22_sig%22%3A%22...%22%7D"

json

{ "deleted": true, "name": "github_token" }

Use it in a tool

Reference a stored secret in a tool's auth config with {{user.creds.<name>}}. At call time EERRAA decrypts the value and substitutes it into the outgoing request. The model sees the placeholder, never the secret.

A tool that authenticates with the stored GitHub token:

json

{
  "auth": {
    "type": "bearer",
    "token": "{{user.creds.github_token}}"
  }
}

To forward a live end-user JWT instead of a stored secret, use {{user.auth_token}}. It carries the token from the current request rather than the vault.

Provisioning secrets from your backend is the common pattern. See the per-user credentials guide for the end-to-end flow.

PREVIOUSHistory, sessions, feedback NEXTKnowledge