Skip to main content
POST
Create a secret

Authorizations

X-API-Key
string
header
required

Body

application/json
name
string
required

Identifier used to reference the secret later (e.g. in the secrets map on POST /sandboxes).

Maximum string length: 128
Pattern: ^[A-Za-z_][A-Za-z0-9_-]*$
value
string
required

Cleartext credential. Encrypted at rest; never returned.

Maximum string length: 8192
provider
string

Built-in provider shortcut (e.g. anthropic, openai, github, stripe). When set, auto-fills auth scheme and allowed upstream hosts. Mutually exclusive with auth and hosts. github emits a per_host config so the same PAT works for both api.github.com REST (Bearer) and github.com git over HTTPS (Basic with x-access-token).

auth
object

Egress auth shape. Use the single-rule form (type + type-specific fields) for credentials that authenticate the same way on every host. Use per_host when the same credential needs different auth schemes on different hosts of the same provider — for example one host accepts Bearer while another accepts Basic with a fixed username. Single-rule and per_host are mutually exclusive.

hosts
string[]

Upstream allow list. Required when auth is set. Each entry is a hostname or single-level wildcard (e.g. api.example.com, *.example.com).

Maximum array length: 16

Response

Secret created

id
string<uuid>
required
name
string
required
auth_type
enum<string>
required

per_host indicates a multi-rule secret; the resolved rules are in auth_config.per_host.

Available options:
bearer,
basic,
api-key,
custom,
per_host
auth_config
object
required

Resolved auth scheme details (no cleartext value).

hosts
string[]
required
created_at
string<date-time>
required
updated_at
string<date-time>
required
provider_shortcut
string | null

Provider shortcut used at creation, if any.

last_used_at
string<date-time> | null

Timestamp of the most recent egress that used this secret.