Create Vault Connection

Create a new external vault connection.

Required Role: ADMIN or OWNER

Tier Limits:

• Free Tier: Maximum 1 vault connection
• Pro Tier: Maximum 10 vault connections

Connects your team to an external vault provider (1Password, Doppler, or Infisical). Credentials are stored encrypted and never returned in API responses.

1Password:

• Requires a service account token (starts with “ops_”)
• No additional configuration needed

Doppler:

• Requires a service token (starts with “dp.st.”)
• Requires project and config

Infisical (Universal Auth / Machine Identity):

• Create a Machine Identity in Project Settings -> Access Control -> Machine Identities
• client_id: UUID from Machine Identity
• client_secret: Secret string from Machine Identity
• project_id: Project ID (UUID) from Project Settings -> General
• environment: Environment slug (e.g., “dev”, “staging”, “prod”, “sandbox”)
• Optional: secret_path (defaults to ”/”)

Example for 1Password:

{
    "name": "1Password Production",
    "vault_type": "onepassword",
    "access_token": "ops_xxx..."
}

Example for Doppler:

{
    "name": "Doppler Production",
    "vault_type": "doppler",
    "access_token": "dp.st.xxx...",
    "project": "my-project",
    "config": "production"
}

Example for Infisical:

{
    "name": "Infisical Production",
    "vault_type": "infisical",
    "client_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "client_secret": "st.abc123xyz...",
    "project_id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
    "environment": "prod",
    "secret_path": "/aws"
}