---
title: "Create a secret"
method: POST
path: "/secrets"
tags: ["secrets"]
---

# Create a secret

`POST /secrets`

Creates Dagu-managed secret metadata in global scope or a named workspace and optionally writes an initial value. Plaintext values are write-only.

## Query parameters

- `remoteNode` string

## Request body

- CreateSecretRequest
  - `workspace` string — Secret scope for management. Use global for workspace-less secrets or a workspace name. Omit for global.
  - `ref` string, required — Secret ref used from DAG YAML, for example prod/db-password.
  - `description` string
  - `providerType` 'dagu-managed', required
  - `value` string — Initial Dagu-managed value. Write-only; never returned by the API.

## Response `201`

Secret created

- SecretResponse
  - `id` string, required
  - `workspace` string, required — global for workspace-less secrets, otherwise the workspace name.
  - `ref` string, required — Secret ref used from DAG YAML, for example prod/db-password.
  - `description` string
  - `providerType` 'dagu-managed' | 'vault' | 'kubernetes' | 'gcp' | 'aws' | 'azure' | 'alibaba', required
  - `providerConnectionId` string
  - `providerRef` string
  - `providerRefFingerprint` string
  - `currentVersion` integer, required
  - `status` 'active' | 'disabled', required
  - `hasValue` boolean, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `lastCheckedAt` string, date-time
  - `lastResolvedAt` string, date-time
  - `lastRotatedAt` string, date-time

## Other responses

- `400` — Invalid request
- `401` — Not authenticated
- `403` — Not authorized
- `409` — Secret already exists
- `default` — Generic error response

---

[API](https://skmtc.net/dagucloud/apis/dagu.md) · [All operations](https://skmtc.net/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/93cc41f2018a/schema)