> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue a Relay Credential from the console

> Mints a short-lived Relay Credential under the authority of a selected
Relay Key. The caller must have the project credential.issue permission;
the Relay Key secret is not accepted or returned.




## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/projects/{id}/credentials
openapi: 3.1.0
info:
  title: Qumo Deploy REST API
  description: >
    The Qumo Deploy REST API provides programmatic control over edge relay
    clusters,

    ephemeral Relay Credential issuance, tenant lifecycle, machine identities,
    and billing.

    Authentication is operation-specific: Relay Keys authenticate relay access
    operations,

    while user sessions and Identity Tokens authenticate control-plane
    operations.
  version: 1.0.0
servers:
  - url: https://api.qumo-deploy.com
    description: Production Control Plane
  - url: http://localhost:8080
    description: Local Development / Sandbox
security:
  - BearerAuth: []
paths:
  /v1/projects/{id}/credentials:
    post:
      summary: Issue a Relay Credential from the console
      description: |
        Mints a short-lived Relay Credential under the authority of a selected
        Relay Key. The caller must have the project credential.issue permission;
        the Relay Key secret is not accepted or returned.
      parameters:
        - in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/IssueCredentialRequest'
                - type: object
                  required:
                    - api_key_id
                  properties:
                    api_key_id:
                      type: string
      responses:
        '200':
          description: Ephemeral Relay Credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssuedCredential'
        '401':
          description: Authentication required
        '403':
          description: Insufficient permission or requested scope
      security:
        - BearerAuth: []
components:
  schemas:
    IssueCredentialRequest:
      type: object
      required:
        - scopes
      properties:
        scopes:
          type: array
          items:
            type: string
            example: relay:session
        ttl_seconds:
          type: integer
          default: 3600
          example: 3600
    IssuedCredential:
      type: object
      required:
        - token
        - expires_at
        - jti
      properties:
        token:
          type: string
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
        expires_at:
          type: string
          format: date-time
          example: '2026-09-12T12:00:00Z'
        jti:
          type: string
          example: c0b7e28e-8a5f-4a3e-bfa1-e28373b984d2
        relays:
          type: array
          items:
            $ref: '#/components/schemas/RelayEndpoint'
        fallback:
          type: array
          items:
            type: string
            example: tyo1.relay.qumo.live:4433
    RelayEndpoint:
      type: object
      required:
        - id
        - region
        - host
        - port
        - url
        - status
      properties:
        id:
          type: string
          example: relay-tyo-01
        region:
          type: string
          example: ap-northeast-1
        host:
          type: string
          example: tyo1.relay.qumo.live
        port:
          type: integer
          example: 4433
        url:
          type: string
          example: https://tyo1.relay.qumo.live:4433
        status:
          type: string
          enum:
            - healthy
            - degraded
          example: healthy
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: SessionOrIdentityToken
      description: |
        User session or Identity Token. Relay Keys are not accepted.

````