---
title: "Owner only (your Pro key, never a bot key)"
method: POST
path: "/api/run/save_login"
---

# Owner only (your Pro key, never a bot key)

`POST /api/run/save_login`

## Request

- Base URL: `https://vault.cloudforbots.com`
- URL: `https://vault.cloudforbots.com/api/run/save_login`
- Auth: one of:
  - none
  - HTTP bearer

Owner only (your Pro key, never a bot key). Store one login sealed with AES-256-GCM, with a scope: allowed hosts, allowed methods, a daily session cap and session TTL. Run it from your own machine, not inside the bot. The password and TOTP secret are never returned by any tool. Free watch-only stores nothing and logs would_use_vault.

## Request body

- object
  - `name` string, required: Short id, e.g. "github-bot" (letters, digits, . _ - @).
  - `domain` string, required: Site the login belongs to, e.g. github.com.
  - `username` string, required
  - `password` string, required
  - `totp_secret` string: Optional base32 TOTP secret, so {{totp}} can fill 2FA codes.
  - `scope` object: Where and how this login may be used.
    - `allowed_hosts` string[]: Hosts the session may call (the login domain is always included; subdomains match). Max 10.
    - `allowed_methods` string[]: HTTP methods session_fetch may use. Default ["GET","POST"].
    - `max_sessions_per_day` integer: Daily cap on open_session for this login, 1-500. Default 20.
    - `ttl_s` integer: Session lifetime in seconds, 60-3600. Default 900.
    - `bot_label` string: Optional note: which bot this login is for.

## Response `200`

Result with job, understood, outcome, usage

- object

## Other responses

- `401`: bad_agent_key
- `429`: free_limit_reached (includes upgrade link)

---

[API](https://skmtc.dev/cloudforbots/apis/login-vault.md) · [All operations](https://skmtc.dev/cloudforbots/apis/login-vault/llms.txt) · [OpenAPI document](https://skmtc.dev/cloudforbots/apis/login-vault/revisions/4b2f0405fb74?raw)