# Credentials (/cli/credentials)





Discover providers, connect accounts, and manage credential access.

Run `sim --output json credentials providers list` to inspect the provider’s fields and authentication requirements before creating a service-account credential. OAuth connection commands return a link that a person must open to authorize the connection.

`sim credentials` is also spelled `sim credential`.

These commands accept the [global options](/cli/commands#global-options).

## Provider discovery and connections [#provider-discovery-and-connections]

### List credential providers [#list-credential-providers]

```bash
sim credentials providers list [options]
```

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--search <value>` | No | Case-insensitive substring match against the credential provider name. |
</CommandTable>

API request and response schemas: [listCredentialProviders](/api-reference/credentials/listCredentialProviders).

### List credentials [#list-credentials]

```bash
sim credentials list [options]
```

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--type <value>` | No | Restrict results to this credential type. Accepted values: `oauth`, `service_account`. |
  | `--provider-id <value>` | No | Restrict results to credentials for this integration provider. |
  | `--search <value>` | No | Case-insensitive substring match against the credential display name. |
  | `--sort-by <value>` | No | Field used to sort the result. Defaults to "createdAt". Accepted values: `displayName`, `createdAt`, `updatedAt`. |
  | `--sort-order <value>` | No | Sort direction. Defaults to "desc". Accepted values: `asc`, `desc`. |
  | `--limit <n>` | No | Maximum items to return (0 for everything). Defaults to `0`. |
</CommandTable>

API request and response schemas: [listCredentials](/api-reference/credentials/listCredentials).

### Create a service-account credential using its discovered provider schema [#create-a-service-account-credential-using-its-discovered-provider-schema]

OAuth login or personal API key required.

```bash
sim credentials create <providerId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `providerId` | Yes | Service-account provider to create a credential for |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--name <displayName>` | Yes | Name shown for the credential in Sim. |
  | `--credentials <json\|@file>` | Yes | Provider credentials as JSON (or @path / @- to read a file or stdin). |
  | `--description <description>` | No | Optional credential description. |
  | `--id <credentialId>` | No | Client-generated credential ID when provider discovery requires it. |
</CommandTable>

API request and response schemas: [createServiceAccountCredential](/api-reference/credentials/createServiceAccountCredential).

### Create a short-lived link for connecting an OAuth provider [#create-a-short-lived-link-for-connecting-an-oauth-provider]

OAuth login or personal API key required.

```bash
sim credentials connect <providerId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `providerId` | Yes | OAuth provider to connect |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--name <displayName>` | Yes | Name shown for the new credential in Sim. |
</CommandTable>

API request and response schemas: [createCredentialConnection](/api-reference/credentials/createCredentialConnection).

### Create a short-lived link for reconnecting an OAuth credential [#create-a-short-lived-link-for-reconnecting-an-oauth-credential]

OAuth login or personal API key required.

```bash
sim credentials reconnect <credentialId>
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Existing OAuth credential to re-authorize |
</CommandTable>

API request and response schemas: [createCredentialConnection](/api-reference/credentials/createCredentialConnection).

### Update credential [#update-credential]

OAuth login or personal API key required.

```bash
sim credentials update <credentialId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Credential to update. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--display-name <value>` | No | New name shown for the credential in Sim. |
  | `--description <value>` | No | New credential description. Send null to clear the stored one. (--description null sends the word, not JSON null). |
  | `--service-account-json <value>` | No | Write-only provider service-account JSON configuration, including Oracle Database connection fields. |
  | `--api-token <value>` | No | Write-only provider API token. |
  | `--domain <value>` | No | Provider account domain. |
  | `--atlassian-product <value>` | No | Atlassian product to verify; defaults to Jira on create and preserves the saved product on reconnect. Accepted values: `jira`, `confluence`. |
  | `--signing-secret <value>` | No | Write-only webhook signing secret. |
  | `--bot-token <value>` | No | Write-only bot token. |
  | `--client-id <value>` | No | OAuth client identifier. |
  | `--client-secret <value>` | No | Write-only OAuth client secret. |
  | `--certificate-id <value>` | No | Provider certificate mapping identifier. |
  | `--org-id <value>` | No | Provider organization ID. |
  | `--data-center <value>` | No | Provider data center. |
  | `--scope <value>` | No | Provider permissions; preserved on reconnect when omitted. |
  | `--auth-method <value>` | No | Provider authentication method. |
  | `--private-key <value>` | No | Write-only PEM private key. |
  | `--username <value>` | No | Provider run-as username. |
  | `--tenancy-ocid <value>` | No | OCI tenancy OCID. |
  | `--user-ocid <value>` | No | OCI user OCID. |
  | `--fingerprint <value>` | No | OCI API-key fingerprint. |
  | `--private-key-passphrase <value>` | No | Write-only OCI private-key passphrase. |
  | `--region <value>` | No | OCI home region. |
  | `--name <displayName>` | No | Alias for --display-name. |
</CommandTable>

API request and response schemas: [updateCredential](/api-reference/credentials/updateCredential).

## Credential members [#credential-members]

### List credential members [#list-credential-members]

OAuth login or personal API key required.

```bash
sim credentials members list <credentialId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Credential whose sharing grants are managed. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--limit <n>` | No | Maximum items to return (0 for everything). Defaults to `0`. |
  | `--sort-by <value>` | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by `name`. Defaults to "email". Accepted values: `email`, `name`. |
  | `--sort-order <value>` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. |
</CommandTable>

API request and response schemas: [listCredentialMembers](/api-reference/credentials/listCredentialMembers).

### Upsert credential member [#upsert-credential-member]

OAuth login or personal API key required.

```bash
sim credentials members upsert <credentialId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Credential whose sharing grants are managed. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--user <value>` | Yes | Existing workspace member to grant or change access for. |
  | `--role <value>` | Yes | Credential role to grant; workspace administrators cannot be demoted. Accepted values: `admin`, `member`. |
</CommandTable>

API request and response schemas: [upsertCredentialMember](/api-reference/credentials/upsertCredentialMember).

### Remove credential member [#remove-credential-member]

OAuth login or personal API key required.

This revokes the selected user’s explicit credential grant.

```bash
sim credentials members remove <credentialId> <userId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Credential whose sharing grants are managed. |
  | `userId` | Yes | User whose explicit grant will be revoked. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `-y, --yes` | Yes | Confirm this operation. |
</CommandTable>

API request and response schemas: [removeCredentialMember](/api-reference/credentials/removeCredentialMember).

## Disconnect credentials [#disconnect-credentials]

### Disconnect credential [#disconnect-credential]

OAuth login or personal API key required.

This disconnects the credential and removes its stored authentication.

```bash
sim credentials delete <credentialId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `credentialId` | Yes | Credential to disconnect. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `-y, --yes` | Yes | Confirm this operation. |
</CommandTable>

API request and response schemas: [deleteCredential](/api-reference/credentials/deleteCredential).

## Related docs [#related-docs]

* [Credentials](/platform/credentials)