Skip to main content
POST
Add a secret version
See the secrets guide for SDK and CLI examples, and credential fill for website logins.

Authorizations

x-api-key
string
header
required

Path Parameters

id
string<uuid>
required

Secret ID.

Body

application/json
envelope
string
required

The value, encrypted on your side as a compact JWE: five canonical, unpadded base64url segments. Wrap the content key with RSA-OAEP-256 using the key from GET /api/secrets/public-key, and encrypt the content with A256GCM. The protected header must hold exactly alg (RSA-OAEP-256), enc (A256GCM), kid (the public key's kid) and ctx (the secret's encryptionContext, copied verbatim). The plaintext is the value as UTF-8: any string for secret; a base32 seed (spaces and hyphens are ignored, = padding only at the end) or an otpauth://totp/ URI (with secret and optionally algorithm SHA1, SHA256 or SHA512, digits 6 or 8, and period 1-300) for totp; a 1Password service account token for op_token. The value can be at most 32 KiB, without NUL bytes, and the envelope at most 64 KiB. The API checks the envelope's structure but can't decrypt it, so it can't check the value: an invalid TOTP seed returns 422 SECRET_VALUE_INVALID when it's used. The Hyperbrowser SDKs and CLI validate the value and build the envelope for you, so we recommend using them rather than encrypting by hand.

Maximum string length: 65536

Response

Success

version
integer
required
Required range: x >= 1
kid
string
required

ID of the public key the envelope was encrypted to.

createdAt
string<date-time>
required