Opened composio#4120 with the full write-up + repro: https://github.com/ComposioHQ/composio/issues/4120 TL;DR — for static schemes (API_KEY, BASIC, BEARER_TOKEN), an invalid credential creates a connected account with status: ACTIVE.

validate_credentials: true

has no effect (despite the typings saying it validates API_KEY), and there's no other endpoint that checks a static key against the vendor. It only fails later at tools.execute with a real 401. Confirmed live on the dashboard: connected Resend with a wrong key → ACTIVE, and it only 401'd when I actually sent an email. We also measured the obvious client-side workaround (probe with a safe, arg-free read and look for a 401) across all 936 static toolkits — only 444 (47%) return a clean 401. The rest are indistinguishable from a working key on a safe call: - 401 → bad key (usable) — 444 - 404 routes before auth — 114 - 403 ACL, could be a valid under-scoped key — 89 - 200 public endpoint, any key "works" — 70 - 400 the get needs an argument — 50 - 401 on an OAuth-capable toolkit, may 401 a valid static key — 45 - unreachable SSRF-blocked / bad base_url — 86 - 5xx / other — 38 Three questions: 1. Is there any first-party way to verify a static credential at connect that I've missed? 2. Any plan to honour

validate_credentials

for API_KEY (or fix the typings)? 3. Side note:

get_current_user_endpoint

is a public URL for some toolkits (jira→serverInfo, serpapi→locations.json), so it 200s any key — worth a look. Full repro + raw API example in the issue.

Hi there, Sorry for the delay in getting back to you here, but we've responded on your Github issue. If you still have any outstanding questions, happy to answer them here.