# Provider configuration schemas

> Define setup configuration, per-Credential parameters, secret slots, labels, help, defaults, and optional fields.

CredentialProviders have two non-secret JSON Schemas and a separate secret-slot declaration. Keeping these inputs separate prevents secrets from entering Resource documents, package metadata, logs, or analytics.

## Provider configuration {#provider-configuration}

`configSchema` describes values shared by one installed provider instance, such as an application client ID, service URL, region, or tenant identifier.

The root must be an object and must set `additionalProperties: false`. Secret-shaped property names and `format: password` are rejected. The Console renders required properties in the main setup form.

## Credential configuration {#credential-configuration}

`credentialConfigSchema` describes non-secret values collected for each output Credential. Examples include installation ID, account ID, requested repository subset, or a least-privilege permission reduction.

Required properties appear in the primary creation step. Optional properties appear under **Optional settings**. Do not mark a value required merely to make the Console display it prominently.

## Supported presentation {#presentation}

| Schema declaration | Console control |
| --- | --- |
| `type: string` | Text or URL input |
| `type: integer` or `number` | Numeric input with bounds |
| `type: boolean` | Styled Yes/No selector |
| `enum` | Styled selector |
| `type: object` or `array` | Structured JSON field |
| `title` | Field label |
| `description` | Contextual help |
| `default` | Initial value |
| `examples` | Example or placeholder |

Use a concise title and a description that tells the operator where the value comes from. Do not repeat the label.

## Bootstrap Credential slots {#bootstrap-slots}

`credentialSlots` declares the secret dependencies provider lifecycle code can request through `context.secret(name)`. Optional `setup.credentialSlots` metadata describes how the Console should collect each slot:

```ts
setup: {
  credentialSlots: {
    "private-key": {
      title: "Application private key",
      description: "Download a PEM key from application settings.",
      documentationUrl: "https://provider.example/key-help",
      input: "file",
      accept: [".pem"]
    }
  }
}
```

Presentation metadata does not change authorization or storage semantics. Each slot still resolves to a governed Credential.

## Validation limits {#validation}

Schemas must use the supported bounded JSON Schema subset. Configuration is validated in the Console for immediate feedback and again at the platform boundary. Unknown fields, oversized documents, invalid types, and secret-shaped configuration are rejected.