---
title: "Add a secret to a vault [write]"
method: POST
path: "/vaults/{id}/secrets"
tags: ["vaults"]
---

# Add a secret to a vault \[write\]

`POST /vaults/{id}/secrets`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/vaults/{id}/secrets`
- Auth: HTTP bearer

`auth.type` picks the kind: static_bearer and mcp_oauth authenticate an MCP server at `mcp_server_url`; environment_variable exposes `secret_name` to the pod. The value is encrypted at rest and never returned.

## Path parameters

- `id` string, required

## Request body

- CreateVaultSecret
  - `display_name` string, required
  - `auth` union, required
    - object
      - `type` 'static_bearer', required
      - `mcp_server_url` string, uri, required: https, public host
      - `token` string, required
    - object
      - `type` 'mcp_oauth', required
      - `mcp_server_url` string, uri, required: https, public host
      - `access_token` string, required
      - `scope` string
      - `expires_at` string
      - `refresh` object
        - `token_endpoint` string, uri, required
        - `client_id` string, required
        - `client_secret` string
        - `refresh_token` string, required
        - `token_endpoint_auth` 'none' | 'client_secret_basic' | 'client_secret_post'
    - object
      - `type` 'environment_variable', required
      - `secret_name` string, required: A valid environment variable name
      - `value` string, required
      - `allowed_hosts` string[]
      - `injection_location` object
        - `header` boolean
        - `body` boolean
        - `header_name` string
        - `value_template` string

## Response `201`

Created

- object
  - `secret` VaultSecret, required: Metadata only — the secret value is never returned after it is written. `secret_name` is set for environment_variable secrets, `mcp_server_url` for the two MCP kinds.
    - `type` 'vault_secret', required
    - `id` string, required: vsec_…
    - `display_name` string, required
    - `auth_type` 'static_bearer' | 'mcp_oauth' | 'environment_variable', required
    - `mcp_server_url` string
    - `secret_name` string: The environment variable the pod sees
    - `allowed_hosts` string[]: Environment-variable destination metadata. An empty list disables credential injection. Omit this field on update to keep the current sites; send [] to clear them.
    - `status` string, required
    - `expires_at` string, date-time
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 2 info
  - added the optional property `error/request_id` to the response with the `default` status
  - added the optional property `secret/allowed_hosts` to the response with the `201` status

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/vaults/:id/secrets/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/8280a065ef6a?raw)