Secrets

Create a new secret. The value is encrypted before storage and will be mounted as a file at `/run/secrets/<KEY>` on the next deployment. The plaintext value is NOT returned — the response carries only metadata.

post/projects/{project_id}/secrets

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/projects/{project_id}/secrets
  • Auth: none declared

Path parameters

project_idinteger required

Project ID

Request body

compose_servicesstring[]

Docker Compose services allowed to read this secret, by compose service name. Empty (the default) delivers it to every service in the stack, which is how secrets behaved before scoping existed.

Ignored by non-Compose presets: those deploy a single container, which always receives every secret in scope for its environment.

environment_idsinteger[]
include_in_previewboolean

Include this secret in preview environments (default: false).

keystring required

Identifier for the secret. Becomes the filename at /run/secrets/<KEY>. Must start with a letter or underscore and contain only A-Z, a-z, 0-9, _.

valuestring required

Plaintext value, <= 1 MiB.

Response

Secret created

compose_servicesstring[] required

Compose services this secret is restricted to. Empty means every service in the stack.

created_atinteger required
idinteger required
include_in_previewboolean required
keystring required
project_idinteger required
updated_atinteger required

Changes

No recorded changes to this operation across all 53 revisions of this API.