Store an encrypted secret
vault_storeDestructiveIdempotent
Store client-side encrypted data. This service holds no key that could decrypt it and never sees plaintext; note that the item key, namespace, alg label and size ARE stored in the clear. The first store claims the namespace and returns a namespace_token shown only once — store it immediately, because it is required by every later call and cannot be recovered. Pass if_match with an item's updated_at for a compare-and-swap write, or if_absent to create only; either returns status 'precondition_failed' rather than silently clobbering a concurrent write. Costs $0.02 in USDC on Base, paid via the x402 protocol, or from a credit token — call credits_trial for free credit if you have neither.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alg | No | Algorithm label recorded alongside the item (default aes-256-gcm) | |
| key | Yes | Item key | |
| ttl | No | Item lifetime in seconds | |
| if_match | No | Only write if the item's current updated_at equals this. Use it whenever you are updating a value you read earlier, or a concurrent writer's change is lost silently. | |
| if_absent | No | Only write if the key does not already exist. Fails with status 'precondition_failed' if it does. | |
| namespace | Yes | Isolation scope | |
| ciphertext | Yes | Encrypt before sending. Plaintext here would be a mistake. | |
| credit_token | No | Optional. A credit token from credits_trial or /credits/buy. Supplying it pays for this call from that balance, so no x402 payment or wallet is needed. | |
| namespace_token | No | One-time token issued by the first call that claimed this namespace. Required for every later call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alg | No | Algorithm label you supplied; the service never decrypts | |
| key | Yes | The key that was written | |
| status | Yes | 'stored' | |
| receipt | No | Payment receipt | |
| namespace | No | Isolation scope | |
| created_at | No | ISO-8601 creation time | |
| expires_at | No | Expiry, or null if it never expires | |
| size_bytes | No | Stored ciphertext size | |
| updated_at | No | ISO-8601 last write | |
| namespace_token | No | Issued only on the first store into a namespace, shown exactly once |