---
title: "Set a function secret"
method: POST
path: "/projects/v1/admin/{project_id}/secrets"
tags: ["Functions"]
---

# Set a function secret

`POST /projects/v1/admin/{project_id}/secrets`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/admin/{project_id}/secrets`
- Auth: HTTP bearer

Sets an environment variable available to all functions in the project.

## Path parameters

- `project_id` string, required: Run402 project ID. Public IDs are not UUIDs.

## Request body

- object
  - `key` string, required
  - `value` string, required

## Response `201`

Secret set

- object
  - `status` string
  - `key` string

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `403`: PROJECT_SCOPE_MISMATCH — a valid project_admin JWT issued for a different project (decided before any project lookup, so the answer never reveals whether the addressed project exists), or FORBIDDEN — a valid JWT of another class. Both carry next_actions; neither is a 401.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)