> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# Set secret

> Create or replace one caller-owned Vault secret.

Create or replace one Vault secret owned by the caller. The `type` field selects
the shape of the request. The response contains safe metadata only.

## Create a login secret

```ts
const login = await bctrl.tools.call("vault.secrets.set", {
  name: "production/github/login",
  type: "login",
  username: process.env.GITHUB_USERNAME!,
  password: process.env.GITHUB_PASSWORD!,
  totpSecret: process.env.GITHUB_TOTP_SECRET!,
  origins: ["https://github.com"],
  label: "GitHub production account",
});
```

## Create a value secret

```ts
const value = await bctrl.tools.call("vault.secrets.set", {
  name: "integrations/github/api-token",
  type: "value",
  value: process.env.GITHUB_API_TOKEN!,
  originPatterns: ["https://*.github.com"],
});
```

## Request parameters

| Parameter        | Type                 | Required    | Description                                                                                                      |
| ---------------- | -------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------- |
| `name`           | `VaultSecretName`    | Yes         | Secret name made from slash-separated letters, numbers, `.`, `_`, `~`, and `-` segments. Maximum 256 characters. |
| `type`           | `"login" \| "value"` | Yes         | Use `login` for username/password credentials or `value` for one opaque value.                                   |
| `username`       | `string`             | Conditional | Required for `login` secrets.                                                                                    |
| `password`       | `string`             | Conditional | Required for `login` secrets.                                                                                    |
| `value`          | `string`             | Conditional | Required for `value` secrets.                                                                                    |
| `totpSecret`     | `string`             | No          | Base32 TOTP seed for a `login` secret.                                                                           |
| `label`          | `string`             | No          | Display label.                                                                                                   |
| `origins`        | `string[]`           | No          | Exact origins allowed to use the secret.                                                                         |
| `originPatterns` | `string[]`           | No          | Origin patterns allowed to use the secret.                                                                       |
| `notes`          | `string`             | No          | Private notes stored with the secret.                                                                            |

## Response

| Field            | Type                 | Always present | Description                               |
| ---------------- | -------------------- | -------------- | ----------------------------------------- |
| `name`           | `VaultSecretName`    | Yes            | Secret name.                              |
| `type`           | `"login" \| "value"` | Yes            | Stored secret shape.                      |
| `label`          | `string`             | No             | Display label, when set.                  |
| `origins`        | `string[]`           | No             | Exact allowed origins, when configured.   |
| `originPatterns` | `string[]`           | No             | Allowed origin patterns, when configured. |
| `hasTotp`        | `boolean`            | Yes            | Whether a TOTP seed exists.               |
| `createdAt`      | `string`             | No             | Creation timestamp, when available.       |
| `updatedAt`      | `string`             | No             | Update timestamp, when available.         |

Secret values are write-only in the response. Keep them in your secret manager
or environment and never log them.

## Next

* [Get secret metadata](/sdk/tools/vault/vault-secrets-get) — inspect safe metadata
* [Update secret](/sdk/tools/vault/vault-secrets-update) — change an existing secret
* [Generate TOTP](/sdk/tools/vault/vault-totp-generate) — create a current code