> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets API: Store Credentials the Gateway Injects

> Create, list, update, and delete workspace secrets with the OneCLI API. The gateway injects them into matching requests so agents never see values.

A secret is a credential, such as an API key or an LLM key, that the gateway injects into outbound requests matching its host and path patterns. Agents use the secret without ever reading its value.

Use these endpoints to manage one workspace's secrets. For keys shared across every workspace, use [Organization secrets](https://onecli.sh/docs/api-reference/organization-secrets). To let an agent use a secret, see [Agent access](https://onecli.sh/docs/guides/agent-access.md).

## Related guides

* [How it works: the gateway injects credentials](https://onecli.sh/docs/how-it-works.md)
* [LLMs: add Anthropic and OpenAI keys](https://onecli.sh/docs/integrations/llms.md)
* [Agent access: grant credentials to agents](https://onecli.sh/docs/guides/agent-access.md)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [List secrets](https://onecli.sh/docs/api-reference/secrets/list-secrets.md) | `GET /secrets` | List your workspace's secrets together with the organization secrets shared into it, newest first. |
| [Create a secret](https://onecli.sh/docs/api-reference/secrets/create-a-secret.md) | `POST /secrets` | Create a workspace secret that the gateway injects into requests matching its host and path patterns. |
| [Update a secret](https://onecli.sh/docs/api-reference/secrets/update-a-secret.md) | `PATCH /secrets/{secretId}` | Update one or more fields on a workspace secret, such as its value or host pattern. |
| [Delete a secret](https://onecli.sh/docs/api-reference/secrets/delete-a-secret.md) | `DELETE /secrets/{secretId}` | Delete a workspace secret and every grant that referenced it. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.