# Credentials

Person-confirms login hand-off and the password-manager bridge.

Person-confirms login hand-off and the password-manager bridge.

## fillCredential

`POST /v1/devices/{deviceId}/credentials/fill`

Type a saved credential into the focused field without revealing it

Needs the `credentials:fill` scope, a site the person has enabled for the password-manager bridge,
and the context checks described in the report (right app or domain, secure field focused, Mac confirmation).
The response never contains the secret, its length, or any part of it.

| Parameter | In | Required | Type | What it is |
|---|---|---|---|---|
| `deviceId` | path | yes | string | Stable device id such as `ios:00008120-001A2B3C4D5E6F70` or `android:R58M123ABC`. |
| `Silan-Lease` | header | no | string | Lease token when the device is claimed. |

Request body: `application/json`.

| Field | Type | What it is |
|---|---|---|
| `site` | string | Site id the person set up, such as "amazon.co.uk". |
| `field` | `username`, `password`, `oneTimeCode` |  |

| Response | Means |
|---|---|
| 200 | Outcome. |
| 4XX | Error (RFC 9457). |
| 5XX | Error (RFC 9457). |

MCP tools on this operation: [`fill_credential`](/reference/mcp/fill-credential/).

## requestPersonLogin

`POST /v1/devices/{deviceId}/credentials/request-person`

Hand the login to the person (default password mode)

| Parameter | In | Required | Type | What it is |
|---|---|---|---|---|
| `deviceId` | path | yes | string | Stable device id such as `ios:00008120-001A2B3C4D5E6F70` or `android:R58M123ABC`. |
| `Silan-Lease` | header | no | string | Lease token when the device is claimed. |

Request body: `application/json`.

| Field | Type | What it is |
|---|---|---|
| `message` | string |  |
| `waitMs` | integer |  |

| Response | Means |
|---|---|
| 200 | The person handed back. |
| 4XX | Error (RFC 9457). |
| 5XX | Error (RFC 9457). |

MCP tools on this operation: [`request_person_login`](/reference/mcp/request-person-login/).

## listCredentialSites

`GET /v1/credentials/sites`

Sites enabled for the password-manager bridge (names only, never secrets)

| Response | Means |
|---|---|
| 200 | Sites. |
| 4XX | Error (RFC 9457). |
| 5XX | Error (RFC 9457). |

MCP tools on this operation: [`list_credential_sites`](/reference/mcp/list-credential-sites/).