لوكلاء AI: ملف markdown لهذه الصفحة — /docs-content-en/search/credentials.md فهرس التوثيق — /llms.txt

مقالات التوثيق متاحة حاليًا باللغة الإنجليزية فقط.

Your own keys (BYOK)

Management of personal keys for paid web-search engines. After you add your own key, subsequent calls to POST /v1/search and POST /v1/research with that provider do not charge Ꝟ — billing goes directly from your account at the provider.

The section supports eight BYOK providers: tavily, brave, exa, you-com, linkup, perplexity, jina, z-ai. The platform bitrix-search is not configured through these endpoints — the platform issues its token centrally.

Scope: vibe:search

List your keys

GET /v1/search/credentials

Returns all of the current user's BYOK keys with the key body hidden. The server stores keys encrypted — the original value cannot be returned, only a mask.

Parameters

No parameters.

Examples

curl — personal key

Terminal 
curl -H "X-Api-Key: YOUR_API_KEY" \
  https://vibecode.bitrix24.com/v1/search/credentials

curl — OAuth application

Terminal 
curl \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  https://vibecode.bitrix24.com/v1/search/credentials

JavaScript — personal key

javascript 
const res = await fetch('https://vibecode.bitrix24.com/v1/search/credentials', {
  headers: { 'X-Api-Key': 'YOUR_API_KEY' },
})

const { credentials } = await res.json()
credentials.forEach((c) => {
  console.log(`${c.provider} · ${c.maskedKey} · ${c.isDefault ? 'default' : 'regular'}`)
})

JavaScript — OAuth application

javascript 
const res = await fetch('https://vibecode.bitrix24.com/v1/search/credentials', {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})

const { credentials } = await res.json()

Response fields

Field Type Description
Fieldcredentials Typearray DescriptionArray of the user's BYOK keys. May be empty
Fieldcredentials[].id Typestring DescriptionKey identifier. Passed to DELETE /v1/search/credentials/:id and POST /v1/search/credentials/:id/test
Fieldcredentials[].provider Typestring DescriptionProvider identifier: one of the eight BYOK (tavily, brave, exa, you-com, linkup, perplexity, jina, z-ai)
Fieldcredentials[].scope Typestring DescriptionKey visibility level. In v1, only USER is returned
Fieldcredentials[].name Typestring DescriptionArbitrary key label
Fieldcredentials[].maskedKey Typestring DescriptionMask <first 5>********<last 4>. The full key cannot be obtained through the API
Fieldcredentials[].isDefault Typeboolean DescriptionConsidered default for the provider. Used when the provider field is omitted in POST /v1/search
Fieldcredentials[].lastVerifiedAt Typestring | null DescriptionDate of the last successful check via POST /v1/search/credentials/:id/test in ISO 8601 format
Fieldcredentials[].lastError Typestring | null DescriptionText of the last verification error. null if the last verification succeeded or there were none
Fieldcredentials[].createdAt Typestring DescriptionDate the key was added, in ISO 8601 format

Response example

JSON 
{
  "credentials": [
    {
      "id": "cmol3pnk5001fo70zefbwb6dl",
      "provider": "tavily",
      "scope": "USER",
      "name": "My Tavily",
      "maskedKey": "tvly-********a1b2",
      "isDefault": true,
      "lastVerifiedAt": "2026-04-30T06:30:00.000Z",
      "lastError": null,
      "createdAt": "2026-04-30T06:26:51.653Z"
    }
  ]
}

Empty list:

JSON 
{ "credentials": [] }

Error response example

401 — no Authorization: Bearer passed for an OAuth key:

JSON 
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "No user context."
  }
}

Errors

HTTP Code Description
HTTP401 CodeMISSING_API_KEY DescriptionThe X-Api-Key header is missing
HTTP401 CodeINVALID_API_KEY DescriptionThe key is not recognized — no such key exists on the platform
HTTP401 CodeUNAUTHORIZED DescriptionThe request goes through a vibe_app_… key without Authorization: Bearer <session_token>
HTTP403 CodeSCOPE_DENIED DescriptionThe key lacks the vibe:search scope
HTTP429 CodeRATE_LIMITED DescriptionThe overall request limit is exceeded
HTTP500 CodeINTERNAL_ERROR DescriptionInternal server error

The full list of common API errors — Errors.

Known specifics

Recovering a lost key. The original value cannot be obtained from the system — the only option after losing a token is to delete the record via DELETE /v1/search/credentials/:id and add the key again.

lastVerifiedAt is updated only via test. Ordinary search requests via POST /v1/search do not move the date — even if the key was actually used successfully. For a fresh timestamp call POST /v1/search/credentials/:id/test.

See also