422
providers.invalid_secret_refprovidersRule R11The credential reference is not usable
paygate stores a reference to a secret, never the secret. The scheme must be sm, env or file. The same code also covers a test-mode credential for a provider with no sandbox endpoint — there is nothing for it to point at.
Why the API refuses
WHEN SetCredential is executed, THE SYSTEM SHALL store the reference only — never the resolved value — and SHALL reject a reference whose scheme is not sm, env or file, and a test-mode credential for a provider that has no sandbox endpoint; RevokeCredential SHALL set valid_to to now and the status to revoked.
What to do
Use sm://… for Secret Manager, env://… for an environment variable, file://… for a mounted file. If you are pasting an actual key into this field, stop: it will be rejected, and if it were not, it would be the wrong place for it.