Create Secret

Create a new secret with credentials stored in Vault or external vault.

Required Role: ADMIN or OWNER

Tier Limits:

• Free Tier: Maximum 5 secrets
• Pro Tier: Maximum 100 secrets

Security Note: Credentials are stored encrypted in PostgreSQL Vault and are NEVER returned in API responses.

Secrets can be created in two ways:

Option 1: Direct credentials - Store credentials in AWS SSM Parameter Store Request body should contain:

• name: Secret name (must be unique within the team)
• description: Optional description
• secret_type: Type of credentials (s3, azure_blob, gcs, etc.)
• auth_method: Authentication method for the provider
• credentials: Provider-specific credentials dict

Option 2: External vault - Reference secrets in 1Password, Doppler, or Infisical Request body should contain:

• name: Secret name (must be unique within the team)
• description: Optional description
• secret_type: Type of credentials (s3, azure_blob, gcs, etc.)
• auth_method: Authentication method for the provider
• vault_connection_id: ID of the vault connection to use
• field_mappings: List of objects

Example for S3 (direct credentials):

{
    "name": "AWS Production Access",
    "description": "S3 access for prod environment",
    "secret_type": "s3",
    "auth_method": "s3_access_key",
    "credentials": {
        "access_key_id": "AKIAIOSFODNN7EXAMPLE",
        "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    }
}

Example for S3 (1Password external vault):

{
    "name": "AWS Production Access",
    "description": "S3 access via 1Password",
    "secret_type": "s3",
    "auth_method": "s3_access_key",
    "vault_connection_id": "uuid-of-1password-connection",
    "field_mappings": [
        {"field_name": "access_key_id", "reference": "op://DevOps/AWS-Prod/access_key_id"},
        {"field_name": "secret_access_key", "reference": "op://DevOps/AWS-Prod/secret_access_key"}
    ]
}

Example for S3 (Doppler external vault):

{
    "name": "AWS Production Access",
    "description": "S3 access via Doppler",
    "secret_type": "s3",
    "auth_method": "s3_access_key",
    "vault_connection_id": "uuid-of-doppler-connection",
    "field_mappings": [
        {"field_name": "access_key_id", "reference": "AWS_ACCESS_KEY_ID"},
        {"field_name": "secret_access_key", "reference": "AWS_SECRET_ACCESS_KEY"}
    ]
}

Example for S3 (Infisical external vault):

{
    "name": "AWS Production Access",
    "description": "S3 access via Infisical",
    "secret_type": "s3",
    "auth_method": "s3_access_key",
    "vault_connection_id": "uuid-of-infisical-connection",
    "field_mappings": [
        {"field_name": "access_key_id", "reference": "AWS_ACCESS_KEY_ID"},
        {"field_name": "secret_access_key", "reference": "AWS_SECRET_ACCESS_KEY"}
    ]
}

Returns:

• 201 Created on success
• 400 Bad Request for validation errors
• 409 Conflict if a secret with the same name already exists in this team

The response will NOT include credentials.