---
title: "Create a secret"
method: POST
path: "/secrets"
tags: ["Secrets"]
---

# Create a secret

`POST /secrets`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/secrets`
- Auth: API key in header `Authorization`

Encrypts and stores a secret. Pass `site_id` to make one site own it, or omit it for a shared secret and list the sites it applies to in `site_ids`. The decrypted `value` comes back in this response only — later reads expose just `last4`.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `name` string, required: Environment-variable name (e.g. STRIPE_SECRET_KEY). Uppercase letters, digits and underscores; cannot start with a digit or use the reserved CREVIO_ prefix.
  - `value` string, required: The secret value to encrypt.
  - `site_id` string: Site that owns the secret. Omit for a shared, account-level secret.
  - `target` 'preview' | 'production': Deployment target the secret applies to. Defaults to `production`.
  - `description` string: Human-readable note about what this secret is for.
  - `site_ids` string[]: Sites a shared secret applies to. Empty leaves it dormant — stored, but injected nowhere.
  - `egress_host` string: Host the in-chat agent may call with this secret injected server-side. The value itself is never exposed to the model.
  - `egress_header` string: Header the secret rides in when calling `egress_host` (e.g. Authorization).

## Response `201`

The secret, including its decrypted value

- Secret
  - `object` string, required
  - `id` string, required
  - `name` string, required
  - `target` string, required
  - `scope` string, required
  - `site_id` string, nullable, required
  - `site_ids` object, required
  - `description` string, nullable, required
  - `egress_host` string, nullable, required
  - `egress_header` string, nullable, required
  - `egress_placement` string, required
  - `egress_signing` object, required
  - `egress_default_headers` object, required
  - `last4` string, required
  - `value` string, nullable, required
  - `created_at` string, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `404`: Resource not found
- `422`: Validation error
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.
- `500`: Internal server error

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)