create_secret - Control Plane

Create an org-scoped secret whose values never pass through this chat. With values "generate", Control Plane fills dictionary keys or an opaque payload with random values now. With values "user", returns a Console link prefilled with the name, type, keys, and defaults for keys whose values are not secret, where the user types the rest. No input accepts a secret value and no result contains one. Databases through add_database get their credentials without this tool. A workload reads a key as cpln://secret/NAME.KEY; deploy_app grants the access, grant_workload_secret_access does it for an existing workload.

Name	Required	Description
`org`	No	Organization slug.
`keys`	No	Dictionary key names. Required to generate a dictionary. For "user", prefills the Console form with these keys.
`name`	Yes	Name for the new org-scoped secret. Pass the name only; names are immutable.
`type`	Yes	Secret type. Generated values support "dictionary" (one value per key) and "opaque" (one payload).
`length`	No	Generated value length in characters (default 32). Only with values "generate".
`values`	Yes	Who supplies the values. "generate": Control Plane fills them with random values now and nobody sees them, for values nobody needs to know (database passwords, signing and session keys, internal tokens). "user": returns a Console link where the user types them, for values only the user has (third-party keys, existing credentials, certificates). Nothing is created in "user" mode until the user saves the form.
`charset`	No	Generated value alphabet (default "alphanumeric", which is safe in connection strings). Only with values "generate".
`defaults`	No	Only with values "user" and a dictionary: starting values the form fills in for some of keys, which the user can change before saving. Only values that are not secret, such as a host, port, username, region, or mode.
`description`	No	Optional description shown on the secret.

Name

Required

Description

Default

org

Organization slug.

keys

Dictionary key names. Required to generate a dictionary. For "user", prefills the Console form with these keys.

name

Yes

Name for the new org-scoped secret. Pass the name only; names are immutable.

type

Yes

Secret type. Generated values support "dictionary" (one value per key) and "opaque" (one payload).

length

Generated value length in characters (default 32). Only with values "generate".

values

Yes

Who supplies the values. "generate": Control Plane fills them with random values now and nobody sees them, for values nobody needs to know (database passwords, signing and session keys, internal tokens). "user": returns a Console link where the user types them, for values only the user has (third-party keys, existing credentials, certificates). Nothing is created in "user" mode until the user saves the form.

charset

Generated value alphabet (default "alphanumeric", which is safe in connection strings). Only with values "generate".

defaults

Only with values "user" and a dictionary: starting values the form fills in for some of keys, which the user can change before saving. Only values that are not secret, such as a host, port, username, region, or mode.

description

Optional description shown on the secret.

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Name

Required

Description

Default

ok

Yes

data

The full result. Read this, not only the summary.

details

summary

Yes

nextSteps

Added value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Only with values \"user\" and a dictionary: starting values the form fills in for some of keys, which the user can change before saving. Only values that are not secret, such as a host, port, username, region, or mode.", + "propertyNames": { + "pattern": "^[-._a-zA-Z0-9]+$" + }, + "type": "object" +}

Control Plane

Create a Secret

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

Resources