---
title: "Create a secret"
method: POST
path: "/v1/secrets"
tags: ["Secrets"]
---

# Create a secret

`POST /v1/secrets`

## Request

- Base URL: `https://api.dexto.ai`
- URL: `https://api.dexto.ai/v1/secrets`
- Auth: HTTP bearer

Create a secret in this key's Cloud project. Agents use it without seeing it: a sandbox tool's commands get a placeholder and Dexto attaches the value to requests to its hosts, and an mcp tool's server gets it from Dexto's servers. Recorded in the organization audit log by name.

## Request body

- object
  - `hosts` string[], required: 1 to 10 exact public hostnames, such as api.stripe.com, that the value may be sent to over HTTPS. No IP addresses, ports, paths, localhost or wildcards.
  - `name` string, required: Unique in the project and fixed: uppercase letters, digits and underscores, starting with a letter. Sandbox commands see it as an environment variable.
  - `placement` union, required: How Dexto attaches the value to each request to the hosts: { "type": "bearer" } sends Authorization: Bearer <value>; { "type": "header", "name": "x-api-key", "prefix": "" } sends it in that header.
    - object: Use only when the client sends Authorization: Bearer <credential>.
      - `type` 'bearer', required
    - object: Use when the client sends the credential in a non-Authorization header.
      - `name` string, required: Exact HTTP header used by the client, for example Project-Access-Token.
      - `prefix` string: Optional value prefix added before the credential, including any required trailing space.
      - `type` 'header', required
  - `value` string, required: The value, at most 16 KiB. It is stored encrypted and never returned.

## Response `201`

Created.

- object
  - `created_at` string, date-time, required
  - `created_by` union, required: The API key that created the secret while it exists; otherwise the person, who may have used an OAuth token.
    - object
      - `api_key_id` string, uuid, nullable, required: Null once the key is deleted.
      - `type` 'api_key', required
    - object
      - `type` 'user', required
      - `user_id` string, required: The person who created it through an OAuth token, or whose key was since deleted.
  - `hint` string, nullable, required: The value's last four characters, when it has at least 20; otherwise null. Never the value.
  - `hosts` string[], required
  - `id` string, uuid, required
  - `last_used_at` string, date-time, nullable, required: When Dexto last attached the value to a request.
  - `name` string, required
  - `object` 'secret', required
  - `placement` union, required
    - object
      - `type` 'bearer', required
    - object
      - `name` string, required
      - `prefix` string
      - `type` 'header', required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Invalid JSON or request fields.
- `401`: Missing or invalid API key.
- `402`: The account has insufficient credits.
- `403`: The account cannot perform this operation.
- `404`: The requested resource was not found.
- `409`: The request conflicts with existing resource state.
- `429`: The account exceeded this operation's request rate.
- `500`: Unexpected Dexto failure.
- `502`: The upstream model provider failed.
- `503`: A required Dexto service is temporarily unavailable.

---

[API](https://skmtc.dev/dexto/apis/dexto-api.md) - [All operations](https://skmtc.dev/dexto/apis/dexto-api/llms.txt) - [OpenAPI document](https://skmtc.dev/dexto/apis/dexto-api/revisions/47eb880cffa5?raw)