Skip to main content
POST
/
org
/
secrets
Create an organization secret
curl --request POST \
  --url https://api.onecli.sh/v1/org/secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Shared Anthropic Key",
  "value": "<string>",
  "hostPattern": "api.anthropic.com",
  "pathPattern": "<string>",
  "injectionConfig": {
    "headerName": "<string>",
    "valueFormat": "<string>"
  }
}
'
{
  "id": "<string>",
  "name": "<string>",
  "type": "<string>",
  "opRef": "<string>",
  "hostPattern": "<string>",
  "pathPattern": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "preview": "<string>"
}

Authorizations

​
Authorization
string
header
required

API key obtained from the dashboard or GET /user/api-key

Body

application/json
​
name
string
required
Required string length: 1 - 255
Example:

"Shared Anthropic Key"

​
type
enum<string>
required
Available options:
anthropic,
openai,
generic
​
value
string
required

The secret value (API key, token, etc.)

Required string length: 1 - 10000
​
hostPattern
string
required

Hostname pattern to match

Example:

"api.anthropic.com"

​
pathPattern
string
Maximum string length: 1000
​
injectionConfig
Header injection · object

How the gateway injects this secret into matching outbound requests (generic secrets only). Exactly one variant:

  • Header — { "headerName": "Authorization", "valueFormat": "Bearer {value}" }
  • Query parameter — { "paramName": "key", "paramFormat": "{value}" }
  • URL path template — { "pathTemplate": "/bot{value}" } (must start with / and contain {value} exactly once)
  • URL path regex — { "pathRegex": "^/bot([^/]+)", "pathReplacement": "/bot{value}" } (replacement must contain {value})

Unknown or mixed keys are rejected.

Response

Secret created

The narrowed secret representation returned by create endpoints.

​
id
string
​
name
string
​
type
string
​
valueSource
enum<string>
Available options:
inline,
onepassword
​
opRef
string
​
hostPattern
string
​
pathPattern
string | null
​
createdAt
string<date-time>
​
preview
string

Masked preview of the value (inline secrets only).