Provider configuration schemas

Define setup configuration, per-Credential parameters, secret slots, labels, help, defaults, and optional fields.

referenceFor provider authors, Console developersOwner Constal platform teamVerified 2026-08-20

CredentialProviders have two non-secret JSON Schemas and a separate secret-slot declaration. Keeping these inputs separate prevents secrets from entering Resource documents, package metadata, logs, or analytics.

Provider configuration

configSchema describes values shared by one installed provider instance, such as an application client ID, service URL, region, or tenant identifier.

The root must be an object and must set additionalProperties: false. Secret-shaped property names and format: password are rejected. The Console renders required properties in the main setup form.

Credential configuration

credentialConfigSchema describes non-secret values collected for each output Credential. Examples include installation ID, account ID, requested repository subset, or a least-privilege permission reduction.

Required properties appear in the primary creation step. Optional properties appear under Optional settings. Do not mark a value required merely to make the Console display it prominently.

Supported presentation

Schema declaration	Console control
`type: string`	Text or URL input
`type: integer` or `number`	Numeric input with bounds
`type: boolean`	Styled Yes/No selector
`enum`	Styled selector
`type: object` or `array`	Structured JSON field
`title`	Field label
`description`	Contextual help
`default`	Initial value
`examples`	Example or placeholder

Use a concise title and a description that tells the operator where the value comes from. Do not repeat the label.

Bootstrap Credential slots

credentialSlots declares the secret dependencies provider lifecycle code can request through context.secret(name). Optional setup.credentialSlots metadata describes how the Console should collect each slot:

setup: {
  credentialSlots: {
    "private-key": {
      title: "Application private key",
      description: "Download a PEM key from application settings.",
      documentationUrl: "https://provider.example/key-help",
      input: "file",
      accept: [".pem"]
    }
  }
}

Presentation metadata does not change authorization or storage semantics. Each slot still resolves to a governed Credential.

Validation limits

Schemas must use the supported bounded JSON Schema subset. Configuration is validated in the Console for immediate feedback and again at the platform boundary. Unknown fields, oversized documents, invalid types, and secret-shaped configuration are rejected.