Set secret

View as Markdown

Create or replace one Vault secret owned by the caller. The type field selects the shape of the request. The response contains safe metadata only.

Create a login secret

1const login = await bctrl.tools.call("vault.secrets.set", {
2 name: "production/github/login",
3 type: "login",
4 username: process.env.GITHUB_USERNAME!,
5 password: process.env.GITHUB_PASSWORD!,
6 totpSecret: process.env.GITHUB_TOTP_SECRET!,
7 origins: ["https://github.com"],
8 label: "GitHub production account",
9});

Create a value secret

1const value = await bctrl.tools.call("vault.secrets.set", {
2 name: "integrations/github/api-token",
3 type: "value",
4 value: process.env.GITHUB_API_TOKEN!,
5 originPatterns: ["https://*.github.com"],
6});

Request parameters

ParameterTypeRequiredDescription
nameVaultSecretNameYesSecret name made from slash-separated letters, numbers, ., _, ~, and - segments. Maximum 256 characters.
type"login" | "value"YesUse login for username/password credentials or value for one opaque value.
usernamestringConditionalRequired for login secrets.
passwordstringConditionalRequired for login secrets.
valuestringConditionalRequired for value secrets.
totpSecretstringNoBase32 TOTP seed for a login secret.
labelstringNoDisplay label.
originsstring[]NoExact origins allowed to use the secret.
originPatternsstring[]NoOrigin patterns allowed to use the secret.
notesstringNoPrivate notes stored with the secret.

Response

FieldTypeAlways presentDescription
nameVaultSecretNameYesSecret name.
type"login" | "value"YesStored secret shape.
labelstringNoDisplay label, when set.
originsstring[]NoExact allowed origins, when configured.
originPatternsstring[]NoAllowed origin patterns, when configured.
hasTotpbooleanYesWhether a TOTP seed exists.
createdAtstringNoCreation timestamp, when available.
updatedAtstringNoUpdate timestamp, when available.

Secret values are write-only in the response. Keep them in your secret manager or environment and never log them.

Next