---
title: "Create a vault"
method: POST
path: "/api/vaults"
---

# Create a vault

`POST /api/vaults`

## Request

- Base URL: `https://api.hyperbrowser.ai`
- URL: `https://api.hyperbrowser.ai/api/vaults`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/docs/api/vaults/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a vault: a set of environment variables that point at your secrets. Pass the vault by name as `vault` to POST /api/sandbox and POST /api/sandbox/{id}/processes, or as `{"vault": name}` in a browser session's `credentials`. A team can have at most 100 vaults. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.manage scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED).

## Request body

- CreateVaultParams
  - `name` string, required: 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team.
  - `description` string: Trimmed before it's stored.
  - `entries` object: Environment variable name to secret. Keys are environment variable names: letters, digits and `_`, not starting with a digit, at most 256 characters. A vault holds at most 32 entries (otherwise 409 VAULT_ENTRY_LIMIT_REACHED).

## Response `200`

Success

- Vault: A named set of environment variables. Holds no values.
  - `id` string, uuid, required
  - `name` string, required: 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team.
  - `description` string, required
  - `entries` object, required: Environment variable name to entry.
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid request body.
- `401`: Authentication required.
- `403`: API_KEY_SCOPE_DENIED (the API key lacks a required scope), SECRETS_FEATURE_DISABLED, or SECRETS_ADMIN_REQUIRED.
- `404`: SECRET_NOT_FOUND or SECRET_VERSION_NOT_FOUND: an entry or the token names a missing secret or version.
- `409`: VAULT_NAME_TAKEN, VAULT_LIMIT_REACHED, VAULT_ENTRY_LIMIT_REACHED, or SECRET_TYPE_MISMATCH (an `op_token` secret as an entry).
- `500`: Internal server error.

## Changes

- **2026-10-15** `225d94fe61a0`: 3 breaking, 6 warning, 4 info
  - added the new required request property `entries/additionalProperties/name`
  - removed `#/components/schemas/VaultStoredEntry, #/components/schemas/VaultOnePasswordEntry` from the `entries/additionalProperties/` request property `oneOf` list
  - the `entries/additionalProperties/` request property type changed from no type to `object`
  - removed the request property `source`
  - …9 more
- **2026-10-15** `6ca0b00ee564`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/changes/api/vaults/post.md)

---

[API](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api.md) - [All operations](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/revisions/ef089024c533?raw)