---
title: "Create a secret"
method: POST
path: "/projects/{projectId}/secrets"
tags: ["Secrets"]
---

# Create a secret

`POST /projects/{projectId}/secrets`

Store a credential so environments can grant it to runs. THE VALUE TRAVELS IN THE REQUEST BODY and becomes visible to whatever makes the call. The response is metadata only. Creating a project-shared secret requires project admin; a personal one does not.

## Headers

- `Idempotency-Key` string

## Request body

- SecretCreateRequest — THE VALUE TRAVELS IN THIS BODY and becomes visible to whatever makes the call — its process, its logs, its shell history. Supply it from a file or an environment variable rather than pasting it into a command.
  - `name` string, required — Environment-variable name. Immutable — renaming is delete-and-recreate.
  - `value` string, required — The credential. Stored encrypted; no route ever returns it. NOT trimmed — a trailing newline is meaningful in a PEM block, and rewriting what you sent would present as 'the key is wrong' with nothing to look at.
  - `description` string
  - `delivery` 'brokered' | 'materialized', required — Required, with no default: a caller who has not said whether the value ends up inside the sandbox has not made the decision this field exists for. See `Secret.delivery`.
  - `brokerHosts` string[] — Required for `brokered`, forbidden for `materialized`. Exact hostnames — no scheme, no port, no wildcard: the proxy matches a host, and a URL installs a rule that silently never fires.
  - `brokerHeader` string — Required for `brokered`, forbidden for `materialized`. e.g. `Authorization`.
  - `brokerTemplate` string — Required for `brokered`, forbidden for `materialized`. The header value with `{}` where the secret goes, e.g. `Bearer {}`. A template without `{}` is rejected: it installs a constant header that never carries the credential.
  - `sharing` 'user' | 'project' — Defaults to `project`. A non-admin asking for it is refused rather than downgraded to personal — a silent downgrade looks like success and then reaches nobody else's sessions.

## Response `201`

The created secret, as metadata.

- Secret — A project credential — METADATA ONLY, always. There is no `value` field on this schema and no route that returns one: a secret is written and delivered into a run, never read back.
  - `id` string, required
  - `projectId` string, required
  - `name` string, required — The environment-variable name (`^[A-Z_][A-Z0-9_]*$`). This IS the secret's identity: what a materialized delivery exports, what a workflow references, and what stays stable across a rotation. Immutable.
  - `description` string, nullable, required
  - `delivery` 'brokered' | 'materialized', required — `brokered` — the sandbox's egress proxy injects the value as a request header OUTSIDE the VM, so the box never holds it. Prevents EXTRACTION, not USE: any process in the box can call the bound host while the policy is live, and it works for HTTPS APIs only (domain rules bind on ports 80/443). `materialized` — a real environment variable inside the box, which is the only thing a CLI can read; EXTRACTABLE BY DESIGN.
  - `brokerHosts` string[] — Brokered only: the exact hostnames the header is injected on.
  - `brokerHeader` string — Brokered only: the header name.
  - `brokerTemplate` string — Brokered only: the header value, with `{}` where the secret goes.
  - `sharing` 'user' | 'project', required — `project` — admin-managed, delivered to every member's sessions. `user` — personal, delivered ONLY in sessions its owner starts and silently absent from anyone else's run of the same environment. Immutable.
  - `ownerUserId` string — Personal secrets only. Project-shared rows have no owner.
  - `lastDeliveredAt` integer, nullable, required — When this secret was last HANDED TO a run — not when it was last used. Brokered use is unobservable by construction (the proxy injects the header; the request is never seen here), so `used` would be a number nobody can honestly produce. `null` means nothing has been recorded, which is not the same as never delivered.
  - `createdAt` integer, required
  - `updatedAt` integer, required
  - `createdByUserId` string, required
  - `updatedByUserId` string, required

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `409` — The resource is not in a state that accepts this write — a stale `expectedRevision`, a duplicate name, or an environment that cannot currently be launched. The request was well-formed; re-read the resource and retry.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.

## Changes

- **2026-09-01** `ce6e4188e558` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mcpjam/apis/mcpjam-api/changes/projects/:projectId/secrets/post.md)

---

[API](https://skmtc.dev/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.dev/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/d1e33646f9d8/schema)