Cloud Credentials

Cloud credentials let an organization connect its own AWS, GCP, or Azure account so Allternit runtimes can provision isolation into the customer’s cloud instead of Allternit’s infrastructure.

Authentication and authorization

Cloud credential endpoints require a Clerk JWT and an active organization. Only organization owners and admins can create or revoke credentials. Members can list and view credentials.

Provider support

Provider	Expected secret shape	Typical fields
`aws`	Role-based	`{ "role_arn": "arn:aws:iam::123456789012:role/AllternitRuntime" }`
`gcp`	Service account	`{ "service_account_json": { ... } }`
`azure`	Client credential	`{ "client_secret": "..." }`

The exact fields inside secret are provider-specific; the API stores the entire object as a single sealed blob.

Endpoints

Method	Path	Description
GET	`/api/v1/cloud-credentials`	List cloud credentials for the organization
POST	`/api/v1/cloud-credentials`	Create a new cloud credential
GET	`/api/v1/cloud-credentials/{id}`	Retrieve a credential by ID
DELETE	`/api/v1/cloud-credentials/{id}`	Soft-revoke a credential

List cloud credentials

curl https://api.allternit.com/api/v1/cloud-credentials \
  -H "Authorization: Bearer $ALLTERNIT_TOKEN"

Response 200 OK

{
  "cloud_credentials": [
    {
      "id": "cc_01J4N",
      "provider": "aws",
      "label": "Production AWS",
      "region": "us-east-1",
      "external_id": "ext_12345",
      "status": "active",
      "last_validated_at": "2026-08-12T10:00:00Z",
      "created_at": "2026-08-01T10:00:00Z"
    }
  ]
}

Create a cloud credential

curl -X POST https://api.allternit.com/api/v1/cloud-credentials \
  -H "Authorization: Bearer $ALLTERNIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "aws",
    "label": "Production AWS",
    "region": "us-east-1",
    "external_id": "ext_12345",
    "secret": {
      "role_arn": "arn:aws:iam::123456789012:role/AllternitRuntime"
    }
  }'

Response 201 Created

{
  "id": "cc_01J4N",
  "provider": "aws",
  "label": "Production AWS",
  "region": "us-east-1",
  "external_id": "ext_12345",
  "status": "active",
  "last_validated_at": null,
  "created_at": "2026-08-12T10:00:00Z"
}

Retrieve a credential

curl https://api.allternit.com/api/v1/cloud-credentials/cc_01J4N \
  -H "Authorization: Bearer $ALLTERNIT_TOKEN"

The secret value is never included in the response.

Revoke a credential

Revocation is soft — the row is kept for audit purposes but its status is set to revoked.

curl -X DELETE https://api.allternit.com/api/v1/cloud-credentials/cc_01J4N \
  -H "Authorization: Bearer $ALLTERNIT_TOKEN"

Response 204 No Content

Request/response fields

Create request body

Field	Type	Required	Description
`provider`	string	yes	One of `aws`, `gcp`, `azure`
`label`	string	yes	Human-readable label; must be unique per organization
`region`	string \| null	no	Cloud region
`external_id`	string \| null	no	External identifier for cross-account trust
`secret`	object	yes	Provider-specific secret payload

Credential object

Field	Type	Description
`id`	string	Unique identifier
`provider`	string	Provider name
`label`	string	Human-readable label
`region`	string \| null	Cloud region
`external_id`	string \| null	External trust identifier
`status`	string	`active` or `revoked`
`last_validated_at`	string \| null	Last successful validation timestamp
`created_at`	string	Creation timestamp

Error codes

HTTP	Code	Meaning
400	`invalid_provider`	Provider is not `aws`, `gcp`, or `azure`
400	`create_failed`	Insert failed, often because the label already exists
400	`no_organization`	Caller has no active organization
403	`insufficient_role`	Caller is not an owner/admin
404	`not_found`	Credential does not exist in this organization
500	`db_error` / `task_join_error`	Unexpected server error

Vault — Encrypted OAuth and provider token storage
BYOC runtime — Deploy Allternit on customer-managed infrastructure
Security model — Trust boundaries and data flows

Get Started

Core Concepts

Gizzi Code CLI

Tools & ACI

Security & Enterprise

Admin API

BYOC Runtime

Surfaces

CI CD

Guides

Cookbooks

Release Notes

Authentication and authorization

Provider support

Endpoints

List cloud credentials

Create a cloud credential

Retrieve a credential

Revoke a credential

Request/response fields

Create request body

Credential object

Error codes

​Authentication and authorization

​Provider support

​Endpoints

​List cloud credentials

​Create a cloud credential

​Retrieve a credential

​Revoke a credential

​Request/response fields

​Create request body

​Credential object

​Error codes

​Related pages

Authentication and authorization

Provider support

Endpoints

List cloud credentials

Create a cloud credential

Retrieve a credential

Revoke a credential

Request/response fields

Create request body

Credential object

Error codes

Related pages