paperclip_create_secret
Create a new encrypted secret for a company to store credentials or API keys. The value is encrypted and never returned, enabling secure agent references.
Instructions
⚠ Board-only: Create a new secret for a company. The value is stored encrypted and is never returned in any response.
Args:
companyId: string — Company UUID
name: string — Secret name (e.g. DATABASE_URL)
value: string — Secret value (stored encrypted, never returned)
provider: enum (optional) — Storage backend: local_encrypted | aws_secrets_manager | gcp_secret_manager | vault (default: local_encrypted)
description: string | null (optional) — Human-readable description
externalRef: string | null (optional) — External reference (e.g. ARN for AWS Secrets Manager)
Returns: Created secret metadata: id, companyId, name, provider, externalRef, latestVersion (starts at 1), description, createdByAgentId, createdByUserId, createdAt, updatedAt. Value is never returned.
Examples:
Use when: registering a new credential or API key that agents or routines will reference by name
Don't use when: the secret already exists and you want to update its value — use paperclip_rotate_secret instead
Error Handling:
400: validation error → check that name and value are non-empty
401: authentication failed → check PAPERCLIP_API_KEY
403: permission denied → this tool requires a board (human-user) API key
409: secret name already exists → use paperclip_rotate_secret to update its value
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| companyId | Yes | Company UUID | |
| name | Yes | Secret name (e.g. DATABASE_URL) | |
| value | Yes | Secret value — stored encrypted, never returned in responses | |
| provider | No | Storage provider (default: local_encrypted) | |
| description | No | Human-readable description | |
| externalRef | No | External reference (e.g. ARN for AWS Secrets Manager) |