Sign in
Vault

Store a workspace secret

Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

put/vault/secrets/{name}

Path parameters

namestring required

Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.

Example:github_token

Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.

Request body

hostsstring[] required

Exact DNS hostnames the secret may be sent to, 1 to 100 entries. Each entry is lowercased and a trailing dot is removed, so API.Example.com. is stored as api.example.com. Schemes, ports, paths, wildcards and empty values are rejected. Duplicates after normalization are collapsed. Matching is exact: a secret bound to api.example.com is never released to example.com or any other hostname.

valuestring required

Secret value, 1 to 65536 characters. It is encrypted at rest and never returned.

Example request

{
  "hosts": [
    "api.github.com"
  ],
  "value": "ghp_exampleTokenValue"
}

Response

Metadata for the stored secret.

Example response

{
  "data": {
    "created_at": "2026-09-15T17:44:00.000Z",
    "fingerprint": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "hosts": [
      "api.github.com"
    ],
    "name": "github_token"
  }
}

Changes