---
title: "POST /api/v1/shared-secrets"
method: POST
path: "/api/v1/shared-secrets"
tags: ["Secret Sharing"]
---

# POST /api/v1/shared-secrets

`POST /api/v1/shared-secrets`

Create a new shared secret that can be accessed by a link.

## Request body

- object
  - `name` string — An optional name for the shared secret for easier identification.
  - `password` string — An optional password to protect the shared secret. Recipients will need to provide this password to access the secret.
  - `secretValue` string, required — The secret value to share.
  - `expiresIn` string — The duration after which the shared secret will expire. Accepts formats like '30d', '24h', '1w'. Maximum is 30 days, minimum is 5 minutes.
  - `maxViews` number — The maximum number of times the shared secret can be viewed before it expires. If not provided, unlimited views are allowed.
  - `accessType` 'anyone' | 'organization' — Determines who can access the shared secret. 'organization' restricts access to users within your organization. 'anyone' allows access to anyone with the link. Defaults to 'organization'.
  - `authorizedEmails` string[] — An optional array of email addresses to share the secret with. Maximum 100 emails. Organization members in the list get direct access. When allowExternalEmails is enabled, non-member emails are also accepted and recipients will receive the secret link via email, but must use the password to access it.
  - `allowExternalEmails` boolean — When true, allows sharing with email addresses that do not belong to Infisical. A password is required when this option is enabled. External recipients will receive the secret link via email and must enter the password to access it.

## Response `200`

Default Response

- object
  - `id` string, required
  - `expiresAt` string, date-time, required
  - `userId` string, uuid, nullable
  - `orgId` string, uuid, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `expiresAfterViews` number, nullable
  - `accessType` string
  - `name` string, nullable
  - `lastViewedAt` string, date-time, nullable
  - `type` string
  - `authorizedEmails` unknown
  - `identityId` string, uuid, nullable
  - `allowExternalEmails` boolean, nullable
  - `sharedSecretLink` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)