---
title: "get_credential Reference | Gazebo Docs"
description: "Full reference for the get_credential MCP tool — parameters, response format, error handling, and usage patterns."
url: "https://gazebohq.com/docs/mcp/get-credential"
---

The `get_credential` tool retrieves a plaintext credential from the Gazebo vault for a named service. Every credential-access attempt is logged in the audit trail regardless of outcome. The value is delivered to the MCP client/agent; do not persist it.

## Parameters

| Parameter | Type | Required | Description |
|---|---|---|---|
| `service` | string | Yes | The service slug (e.g. `"stripe"`, `"github"`, `"vercel"`) |
| `method` | string | Yes | The HTTP method you intend to use the credential for (`"GET"`, `"POST"`, `"PUT"`, `"PATCH"`, `"DELETE"`) |
| `key_name` | string | No | The named credential to retrieve. Omit it to retrieve the service's primary credential. |

The `method` parameter is policy-enforced — declaring `"POST"` when you intend to make a write call is not optional. If your access profile doesn't permit `POST` on that service, the call is denied and logged.

## Success response

On success, `get_credential` returns the plaintext credential as a string:

```
get_credential({ service: "stripe", method: "GET" })
→ "<scoped-service-credential>"
```

Use this value directly in your API call. Do not persist it; retrieve it again when needed.

## Denial response

If the agent is not permitted to access the service or method, `get_credential` returns a structured JSON object:

```json
{
  "status": "denied",
  "service": "stripe",
  "method": "DELETE",
  "allowed_methods": ["GET", "POST"],
  "reason": "Method DELETE is not permitted for service stripe",
  "next_action": "Update the agent's access profile to include DELETE, or use a permitted method."
}
```

**On denial, do not retry without user intervention.** The policy will not change between calls. Parse the response, tell the user what happened (including `next_action`), and stop.

## Not-found response

If no credential is stored for the requested service:

```json
{
  "status": "not_found",
  "service": "stripe",
  "reason": "No credential stored for service stripe",
  "next_action": "Connect Stripe in the Gazebo dashboard under Settings → Services."
}
```

## Error table

| HTTP status | `status` field | Meaning |
|---|---|---|
| 200 | — | Credential returned as plain string |
| 403 | `denied` | Service not in access profile, or method not permitted |
| 404 | `not_found` | No credential stored for this service |
| 401 | — | Invalid or missing bearer token |

## Recommended usage pattern

```
1. get_identity()                           → confirm accessible services
2. get_credential({ service, method })      → fetch the credential
3. [make your API call using the credential]
4. list_audit_events({ service, limit: 1 }) → optionally confirm it was logged
```

Do not store the returned credential in memory beyond the scope of the current API call. Treat it as ephemeral.