Unary · Secrets
Creates a new secret for a project.
Use this method to:
- Store sensitive configuration values
- Set up environment variables
- Configure registry authentication
- Add file-based secrets
Examples
-
Create environment variable:
Creates a secret that will be available as an environment variable.
name: "DATABASE_URL" projectId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" value: "postgresql://user:pass@localhost:5432/db" environmentVariable: true -
Create file secret:
Creates a secret that will be mounted as a file.
name: "SSH_KEY" projectId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" value: "-----BEGIN RSA PRIVATE KEY-----\n..." filePath: "/home/gitpod/.ssh/id_rsa" -
Create registry auth:
Creates credentials for private container registry.
name: "DOCKER_AUTH" projectId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" value: "username:password" containerRegistryBasicAuthHost: "https://registry.example.com"
Endpoint
POST /api/gitpod.v1.SecretService/CreateSecret
https://app.ona.com with that domain.
Request example
export ONA_HOST=https://app.ona.com
export ONA_API_KEY=<your-token>
curl --request POST \
--url "$ONA_HOST/api/gitpod.v1.SecretService/CreateSecret" \
--header "Authorization: Bearer $ONA_API_KEY" \
--header "Content-Type: application/json" \
--data '{
"filePath": "<file-path>"
}'
import gitpod.v1.secret_pb2 as secret_pb2
from ona_sdk import create_client_from_env
ona = create_client_from_env()
request = secret_pb2.CreateSecretRequest(
file_path="<file-path>",
)
response = ona.services.secret.create_secret(request)
print(response)
import { create } from "@bufbuild/protobuf";
import { createClientFromEnv } from "@gitpod/sdk";
import { CreateSecretRequestSchema } from "@gitpod/sdk/gitpod/v1/secret_pb";
async function main() {
const ona = createClientFromEnv();
const request = create(CreateSecretRequestSchema, {
mount: {
case: "filePath",
value: "<file-path>",
},
});
const response = await ona.services.secret.createSecret(request);
console.log(response);
}
main().catch(console.error);
package main
import (
"context"
"fmt"
"log"
"connectrpc.com/connect"
"github.com/gitpod-io/gitpod-sdk-go/sdk"
gitpodpb "github.com/gitpod-io/gitpod-sdk-go/v1"
)
func main() {
ona, err := sdk.NewFromEnv()
if err != nil {
log.Fatal(err)
}
request := connect.NewRequest(&gitpodpb.CreateSecretRequest{
Mount: &gitpodpb.CreateSecretRequest_FilePath{
FilePath: "<file-path>",
},
})
response, err := ona.Services.Secret.CreateSecret(context.Background(), request)
if err != nil {
log.Fatal(err)
}
fmt.Println(response.Msg)
}
{
"filePath": "<file-path>"
}
Request
gitpod.v1.CreateSecretRequest
| Field | Type | Required | Description |
|---|---|---|---|
name | string | No | Constraints: string.max_len=127, string.min_len=3, string.pattern=^[0-9a-zA-Z_]{3,}$. |
projectId | string | No | Deprecated. project_id is the ProjectID this Secret belongs to Deprecated: use scope instead |
value | string | No | value is the plaintext value of the secret. When set, source must be unset or verbatim. Constraints: string.max_len=10240, string.min_len=0. |
source | Source | No | source is the source of the secret, possibly verbatim value |
filePath | string | One of mount | absolute path to the file where the secret is mounted Constraints: cel.expression=this.matches('^/[^/].*$'), cel.id=absolute_path, cel.message=value must be an absolute path (e.g. /path/to/file). |
environmentVariable | boolean | One of mount | secret will be created as an Environment Variable with the same name as the secret |
containerRegistryBasicAuthHost | string | One of mount | secret will be mounted as a docker config in the environment VM, mount will have the docker registry host |
apiOnly | boolean | One of mount | api_only indicates the secret is only available via API/CLI. These secrets are NOT automatically injected into services or devcontainers. Useful for secrets that should only be consumed programmatically (e.g., by security agents). |
credentialProxy | CredentialProxy | No | credential_proxy configures transparent credential injection when environments materialize this secret. When set, the credential proxy intercepts HTTPS traffic to the target hosts and replaces the dummy mounted value with the real value in the specified HTTP header. The real secret value is never exposed in the environment. This field is orthogonal to mount - a secret can be both mounted and proxied at the same time. |
scope | SecretScope | No | scope is the scope of the secret |
Response
gitpod.v1.CreateSecretResponse
| Field | Type | Required | Description |
|---|---|---|---|
secret | Secret | No |
Related types
Secret
Secret
gitpod.v1.Secret| Field | Type | Required | Description |
|---|---|---|---|
id | string | No | Constraints: string.uuid=true. |
name | string | No | Name of the secret for humans. |
projectId | string | No | Deprecated. The Project ID this Secret belongs to Deprecated: use scope instead Constraints: string.uuid=true. |
createdAt | RFC 3339 timestamp | No | |
updatedAt | RFC 3339 timestamp | No | |
creator | Subject | No | creator is the identity of the creator of the secret |
filePath | string | One of mount | absolute path to the file where the secret is mounted |
environmentVariable | boolean | One of mount | secret will be created as an Environment Variable with the same name as the secret |
containerRegistryBasicAuthHost | string | One of mount | secret will be mounted as a registry secret Constraints: string.uri=true. |
apiOnly | boolean | One of mount | api_only indicates the secret is only available via API/CLI |
scope | SecretScope | No | |
credentialProxy | CredentialProxy | No | credential_proxy configures transparent credential injection via the credential proxy. When set, the credential proxy intercepts HTTPS traffic to the target hosts and replaces the dummy mounted value with the real value in the specified HTTP header. The real secret value is never exposed in the environment. This field is orthogonal to mount - a secret can be both mounted and proxied at the same time. |
source | Source | No | Source of the secret |
CredentialProxy
CredentialProxy
CredentialProxy describes how the credential proxy should inject this
secret into outgoing HTTPS requests.
gitpod.v1.Secret.CredentialProxy| Field | Type | Required | Description |
|---|---|---|---|
targetHosts | array of string | No | target_hosts lists the hostnames to intercept (for example “github.com” or “*.github.com”). Wildcards are subdomain-only and do not match the apex domain. |
header | string | No | header is the HTTP header name to inject (e.g. “Authorization”). |
Source
Source
Source defines
gitpod.v1.Secret.Source| Field | Type | Required | Description |
|---|---|---|---|
verbatim | boolean | No | |
oidcJfrog | OidcJFrog | No |
OidcJFrog
OidcJFrog
gitpod.v1.Secret.Source.OidcJFrog| Field | Type | Required | Description |
|---|---|---|---|
host | string | No | Constraints: cel.expression=this.matches("^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?[.])*[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$"), cel.id=host_or_host_port, cel.message=host must be a hostname or IP address with optional port, string.min_len=1. |
providerName | string | No | Constraints: string.min_len=1. |
SecretScope
SecretScope
gitpod.v1.SecretScope| Field | Type | Required | Description |
|---|---|---|---|
projectId | string | No | project_id is the Project ID this Secret belongs to Constraints: string.uuid=true. |
userId | string | No | user_id is the User ID this Secret belongs to Constraints: string.uuid=true. |
organizationId | string | No | organization_id is the Organization ID this Secret belongs to Constraints: string.uuid=true. |
serviceAccountId | string | No | service_account_id is the Service Account ID this Secret belongs to Constraints: string.uuid=true. |
Subject
Subject
gitpod.v1.Subject| Field | Type | Required | Description |
|---|---|---|---|
id | string | No | id is the UUID of the subject Constraints: ignore=1, string.uuid=true. |
principal | Principal | No | Principal is the principal of the subject Constraints: enum.defined_only=true. |
Principal
Principal
| Value | Number | Description |
|---|---|---|
PRINCIPAL_UNSPECIFIED | 0 | |
PRINCIPAL_ACCOUNT | 1 | |
PRINCIPAL_USER | 2 | |
PRINCIPAL_RUNNER | 3 | |
PRINCIPAL_ENVIRONMENT | 4 | |
PRINCIPAL_SERVICE_ACCOUNT | 5 | |
PRINCIPAL_RUNNER_MANAGER | 6 |