External Authentication Credentials API V3 — Developer Guide

• Applies to: Sprinklr External Authentication Credentials API V3 (/api/v3/connector-cred)
• V2 API reference: External Authentication Credential APIs | Sprinklr Developer Portal

The External Authentication Credentials APIs let you create and delete external API credentials inside Sprinklr, so Sprinklr can authenticate outbound calls to third-party applications on your behalf. Once a credential exists, Sprinklr modules — Bots, Guided Workflows, Agent Consoles, Care Consoles, Automation, and External REST API connectors — reference it by ID instead of storing secrets in each configuration.

The stored object is a connector credential: a named record holding an authType plus whatever fields that auth flow needs (client ID and secret, refresh token, JWT signing secret, API key, and so on). Sprinklr performs the token exchange at call time.

V3 exposes the credential lifecycle on a single resource path — /api/v3/connector-cred — differentiated by HTTP method:

This is the central design change from V2, which documented eight separate create pages all posting to the same POST /api/v2/connector-cred/create endpoint, differentiated only by the authType value in the body.

For more details refer to Connector Credential API Reference.

A connector credential has three conceptual layers:

Which fields you populate is driven entirely by authType. §4.1 gives the per-flow field tables.

A credential is addressed by the credential ID returned when it was created — a 24-character hex ObjectId, for example 679228515882ec48d9c99e62.

⚠️ Capture the ID at creation time. The create call returns the credential ID and it is the only handle you get. There is no read or list endpoint in either V2 or V3, so an ID you fail to persist cannot be recovered through the API — you would have to look the credential up in the Sprinklr UI. See §5.

All API calls are sent to the production endpoint:

https://api3.sprinklr.com/{env}/api/v3

So the connector credential resource in production is:

https://api3.sprinklr.com/{env}/api/v3/connector-cred

Replace {env} with your assigned environment identifier. See APIs | Sprinklr Developer Portal for the current environment list.

All External Authentication Credentials API calls are authenticated with OAuth 2.0. See Developer Tools in Sprinklr for API key and secret generation, and the Authorize flow.

Permissions. Access to this API is more restricted than most Sprinklr APIs:

• Only Global Admins and Global Users can add external APIs in Sprinklr.
• The calling user needs the External Authentication Credentials permission and the External API permission.
• To grant access, an administrator creates a custom role with the required permissions and assigns it to the appropriate user or user group.
• Your organization must be on the Sprinklr Enterprise edition.

Missing permission returns 403 Forbidden.

Do not confuse the two credential layers. The Authorization and Key headers authenticate you to Sprinklr. The body of the create call contains the credentials Sprinklr will use to authenticate itself to a third party. Both are secrets; neither should ever be logged or committed.

operationId: ConnectorCredentialApiV3_createConnectorCredential Summary: Create connector credentials.

The authType in the body already determines the flow, so separate endpoints added no value.

Required on every request: name, authType.

The following per-flow requirements are carried forward from the V2 reference pages. V3 keeps the same field names.

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
     "name": "Shivangi Test Basic", 
    "authType": "BASIC", 
    "grantType": "client_credentials", 
    "userId": "shivangi.singh+test@sprinklr.com", 
    "password": "1234@", 
    "requestViaProxy": true 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
   "name": "Shivangi Test Basic", 
    "authType": "STD_BASIC_AUTH", 
    "grantType": "client_credentials", 
    "userId": "shivangi.singh+test@sprinklr.com", 
    "password": "1234@", 
    "requestViaProxy": true 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "name": "Avinash Test OAuth 1", 
    "authType": "OAUTH_REFRESH", 
    "tokenEndpoint": "https://www.google.com", 
    "oauthClientId": "shivangi+test@sprinklr.com", 
    "oauthClientSecret": "56789abcdefgh", 
    "oauthRefreshToken": " E13zqlMcOuEMobsKSLvdqCU4A6e1jddL8oM36tx8oQE1MTQzYmY2Ni0wM2U2LTM2NmUtOWFkMy01MGI5ZTE1ZjIwYTA=" 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
   "name": "Shivangi Test Password", 
    "authType": "OAUTH_PASSWORD", 
    "tokenEndpoint": "https://www.google.com", 
    "userId": " shivangi.singh+test@sprinklr.com ", 
    "password": "1234@" 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
 "name": "Shivangi Test OAuth Client", 
    "authType": "OAUTH_TOKEN", 
    "tokenEndpoint": "https://www.google.com", 
    "oauthClientId": "shivangi+test@sprinklr.com", 
    "oauthClientSecret": "56789abcdefgh " 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "name": "Shivangi Test OAuth", 
    "authType": "OAUTH_1", 
    "tokenEndpoint": "https://www.google.com", 
    "oauthClientId": "shivangi+test@sprinklr.com", 
    "oauthClientSecret": "56789abcdefgh ", 
    "addAuthDataTo": "request", 
    "oauthAccessToken": "E13zqlMcOuEMobsKSLvdqCU4A6e1jddL8oM36tx8", 
    "oauthAccessTokenSecret": "MeE6EjoFfmsMa9Wy6RMSiYXxKpF3VSpSHx" 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "name": "Shivangi Test JWT",  
    "authType": "JWT",  
    "signatureAlgorithm": "HS256",  
    "jwtSecret": "asd",  
    "jwtClaims": { 
                    "userRole": "admin", 
                    "organizationId": "org-12345", 
                    "isVerified": true 
    },  
    "jwtHeaders": {  
                     "x-client-id": "12345",  
                     "x-request-id": "abcde-12345"  
                       }  
    } 
}'

curl --location 'https://api3.sprinklr.com/{env}/api/v3/connector-cred' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Key: {{apiKey}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "name": "Acme API Key",
    "authType": "API_KEY",
    "apiKey": "acmeapikey@1234",
    "password": "acme@1234"
}'

{
    "data": "67990812259f4a0ca47468ab",
    "errors": []
}

Duplicate names are rejected. "When attempting to create connector credentials, the API will return a 400 Bad Request error response if the provided credential name already exists." Name your credentials deterministically and handle 400 as "already exists", not as a malformed payload.

operationId: ConnectorCredentialApiV3_deleteCredentials Summary: Delete connector credentials by id.

Replaces DELETE /api/v2/connector-cred/{credentialId}. The credential ID moves from a path segment to a query parameter, consistent with the V3 pattern.

curl --location --request DELETE \
  'https://api3.sprinklr.com/{env}/api/v3/connector-cred?id=679228515882ec48d9c99e62' \
  --header 'Authorization: Bearer {{accessToken}}' \
  --header 'Key: {{apiKey}}' \
  --header 'Accept: application/json'

(illustrative example, in the V2 envelope shape)

{
    "data": true,
    "errors": []
}

V3 exposes no read, list, or search operation for connector credentials. Neither does V2.

This has three practical consequences:

1. Persist the credential ID at creation time. The POST response is the only place the ID is returned programmatically. Store it alongside your own record of which integration uses it.
2. There is no API to verify a credential exists before deleting it or before pointing a module at it. Attempting the delete is the only programmatic probe, and that is destructive.
3. There is no update operation. To rotate a secret — a new client secret, a new refresh token, a new API key — you must create a new credential and delete the old one, then repoint any module that referenced it. Plan rotation as a create-repoint-delete sequence, not an in-place edit.

To view or edit existing credentials interactively, use Connections Manager in the Sprinklr UI (Launchpad → Platform Modules → Listen → Settings → All Settings → APIs & Integrations → Connections Manager, or on the old settings page, Manage Customer → Connections Manager). Connections Manager supports Edit and Delete per connection, plus filtering by connection type, authentication type, platform type, and creator. See §10.

Every V2 External Authentication Credentials example returns the standard Sprinklr envelope:

{
    "data": "67990812259f4a0ca47468ab",
    "errors": []
}

The OpenAPI document declares the same response set on both operations:

500 Internal Server Error is not declared on these operations in the supplied specification; handle it defensively regardless.

• Verb removed from path — /connector-cred/create → /connector-cred; POST already implies creation.
• credentialId moves to query param — /connector-cred/{credentialId} → /connector-cred?credentialId={id}, consistent with v3 pattern.

The nine supported values, with the V2 descriptions:

Scenario: your infrastructure-as-code pipeline stands up a new Sprinklr workspace and must register the CRM connection automatically.

POST /api/v3/connector-cred
{ "name": "acme-crm-prod", "authType": "OAUTH_TOKEN", "tokenEndpoint": "...",
  "oauthClientId": "...", "oauthClientSecret": "...", "scope": "..." }

Capture data from the response and write it to your own configuration store. It is the only handle to the credential.

Scenario: your pipeline re-runs and must not fail on an already-provisioned credential.

There is no "get by name" endpoint, so idempotency must be built on the documented 400-on-duplicate-name behavior:

POST /api/v3/connector-cred  →  400  ⇒  credential with this name already exists

Use deterministic names (acme-crm-prod, not acme-crm-2026-08-30) and treat 400 on create as a benign "already exists" only when your payload is known-valid. Because 400 also covers genuine validation failures, inspect errors[].message to distinguish the two rather than branching on the status code alone.

Scenario: a third-party client secret has been rotated upstream and must be updated in Sprinklr.

There is no update endpoint, so rotation is a three-step sequence:

1. POST /api/v3/connector-cred with a new name and the new secret → capture the new ID.
2. Repoint the consuming module(s) — External REST API connector, Bot, Guided Workflow — at the new credential.
3. DELETE /api/v3/connector-cred?id={oldId}.

Do not delete first. Between step 1 and step 2 both credentials exist, which is what keeps the integration up during rotation.

Scenario: a partner API requires an HS256-signed JWT with custom claims and headers on every call.

POST /api/v3/connector-cred
{ "name": "partner-jwt", "authType": "JWT", "signatureAlgorithm": "HS256",
  "jwtSecret": "{{externalJwtSecret}}",
  "jwtClaims": { "userRole": "admin", "organizationId": "org-12345" },
  "jwtHeaders": { "x-client-id": "12345" } }

jwtClaims values are typed as Object in the specification, so booleans and numbers are valid claim values, not just strings — the V2 example includes "isVerified": true.

Scenario: the third-party token endpoint expects form-encoded parameters and a non-standard response body.

Use authType: CUSTOM_AUTH with httpMethod, contentTypeHeader, customTokenParams, and customTokenHeaders, and supply Groovy scripts via preRequestScript (build the request) and responseAdapter (parse the response). These script fields execute inside Sprinklr — treat them as production code and review them accordingly.

Scenario: a third-party system is being retired.

1. Confirm no Sprinklr module still references the credential — this must be checked in Connections Manager in the UI, since no API lists credential usage.
2. DELETE /api/v3/connector-cred?id={id}.
3. Treat both data: true and a 404 as success; treat data: false as "already gone".

Secret handling — read this first

• This API transports third-party secrets in request bodies. Never log request bodies, never commit them, and never echo them into CI output.
• The API returns only an ID. It does not return stored secrets — do not build any flow that assumes you can read a secret back.
• Use placeholders in all shared examples and runbooks ({{externalClientSecret}}, {{externalPassword}}).
• The Authorization/Key headers and the body credentials are two different secrets serving two different trust boundaries. Rotate them on independent schedules.
• preRequestScript, responseAdapter, customClaimsAdapter, and customTokenHeadersAdapter accept Groovy scripts that Sprinklr executes. Subject them to the same review as any deployed code.

No read, no update

• Persist the credential ID returned by POST. It is unrecoverable through the API.
• Rotation is create → repoint → delete. There is no in-place edit.
• You cannot programmatically check whether a credential exists without attempting a destructive delete.

Naming

• Credential names must be unique; a duplicate returns 400 Bad Request, not a conflict-specific status.
• Use deterministic, environment-scoped names so re-runs are predictable.

Access control

• Only Global Admins and Global Users can add external APIs.
• The caller needs both the External Authentication Credentials and External API permissions, granted via a custom role.
• Enterprise edition is required.

Static authentication

• For static (key-based) authentication, there is no need to add external authentication credentials in Sprinklr at all. Check whether your integration needs a stored credential before creating one.

All JSON payloads in this guide are illustrative examples derived from the supplied specifications and published references. They are not real customer data and are not guaranteed production responses. All credentials are placeholders ({{accessToken}}, {{apiKey}}, {{externalClientSecret}}, and similar) and must never be committed or logged.