> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stablebrowse.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set credentials

> Upload per-platform cookies for one of your end-users. Idempotent upsert; unspecified platforms are untouched.

## Path parameters

<ParamField path="endUserId" type="string" required>
  Opaque identifier for the end-user. Must be ≤ 256 characters.
</ParamField>

## Request body

All fields are optional — include only the platforms you want to set or update. Existing credentials for platforms you don't mention stay in place.

<ParamField body="twitterAuthToken" type="string" />

<ParamField body="twitterCt0" type="string" />

<ParamField body="redditSession" type="string" />

<ParamField body="tiktokSessionId" type="string" />

<ParamField body="tiktokCsrfToken" type="string" />

<ParamField body="instagramSessionId" type="string" />

<ParamField body="instagramCsrfToken" type="string" />

<ParamField body="instagramDsUserId" type="string" />

See [Platforms](/concepts/platforms) for where to find each cookie in your browser.

## Response — `200 OK`

<ResponseField name="ok" type="boolean">
  Always `true` on success.
</ResponseField>

## Example

<CodeGroup>
  ```bash curl theme={null}
  curl "$API_BASE/end-users/alice/credentials" -X PUT \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "twitterAuthToken": "...",
      "twitterCt0": "..."
    }'
  ```

  ```python Python theme={null}
  client.end_users("alice").credentials.set(
      twitter_auth_token="...",
      twitter_ct0="...",
  )
  ```

  ```typescript TypeScript theme={null}
  await client.endUsers("alice").credentials.set({
    twitterAuthToken: "...",
    twitterCt0: "...",
  });
  ```
</CodeGroup>

## Security notes

* Credentials are **KMS-encrypted at rest** with a key that only the stablebrowse workers can decrypt.
* They're **never returned** by any GET endpoint. The status endpoint returns only "configured: true/false" flags.
* They're **scoped to `(businessId, endUserId)`**. Two businesses can both have an `alice` end-user with independent credentials.
* **On suspicion of leak**, call [`DELETE /v1/end-users/{endUserId}/credentials`](/api-reference/end-users/delete-credentials) and re-upload fresh ones.

## Errors

| Code  | Meaning                                                                           |
| ----- | --------------------------------------------------------------------------------- |
| `400` | `endUserId` > 256 chars, invalid JSON body, or no recognized cred fields supplied |
| `401` | Missing `Authorization` header                                                    |
| `403` | Revoked API key                                                                   |