curl --request PUT \
--url https://openrouter.ai/api/v1/vault/secrets/{name} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hosts": [
"api.github.com"
],
"value": "ghp_exampleTokenValue"
}
'import requests
url = "https://openrouter.ai/api/v1/vault/secrets/{name}"
payload = {
"hosts": ["api.github.com"],
"value": "ghp_exampleTokenValue"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({hosts: ['api.github.com'], value: 'ghp_exampleTokenValue'})
};
fetch('https://openrouter.ai/api/v1/vault/secrets/{name}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://openrouter.ai/api/v1/vault/secrets/{name}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'hosts' => [
'api.github.com'
],
'value' => 'ghp_exampleTokenValue'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://openrouter.ai/api/v1/vault/secrets/{name}"
payload := strings.NewReader("{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://openrouter.ai/api/v1/vault/secrets/{name}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://openrouter.ai/api/v1/vault/secrets/{name}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"created_at": "2026-09-15T17:44:00.000Z",
"fingerprint": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"hosts": [
"api.github.com"
],
"name": "github_token"
}
}Store a workspace secret
Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.
curl --request PUT \
--url https://openrouter.ai/api/v1/vault/secrets/{name} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hosts": [
"api.github.com"
],
"value": "ghp_exampleTokenValue"
}
'import requests
url = "https://openrouter.ai/api/v1/vault/secrets/{name}"
payload = {
"hosts": ["api.github.com"],
"value": "ghp_exampleTokenValue"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({hosts: ['api.github.com'], value: 'ghp_exampleTokenValue'})
};
fetch('https://openrouter.ai/api/v1/vault/secrets/{name}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://openrouter.ai/api/v1/vault/secrets/{name}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'hosts' => [
'api.github.com'
],
'value' => 'ghp_exampleTokenValue'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://openrouter.ai/api/v1/vault/secrets/{name}"
payload := strings.NewReader("{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://openrouter.ai/api/v1/vault/secrets/{name}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://openrouter.ai/api/v1/vault/secrets/{name}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"hosts\": [\n \"api.github.com\"\n ],\n \"value\": \"ghp_exampleTokenValue\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"created_at": "2026-09-15T17:44:00.000Z",
"fingerprint": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"hosts": [
"api.github.com"
],
"name": "github_token"
}
}Authorizations
API key as bearer token in Authorization header
Path Parameters
Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.
1 - 255^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$"github_token"
Body
Secret value and the exact hostnames it may be released to.
Exact DNS hostnames the secret may be sent to, 1 to 100 entries. Each entry is lowercased and a trailing dot is removed, so API.Example.com. is stored as api.example.com. Schemes, ports, paths, wildcards and empty values are rejected. Duplicates after normalization are collapsed. Matching is exact: a secret bound to api.example.com is never released to example.com or any other hostname.
1 - 100 elements254Secret value, 1 to 65536 characters. It is encrypted at rest and never returned.
1 - 65536Response
Metadata for the stored secret.
Metadata for the stored secret.
Metadata for one stored secret. The secret value is never returned. fingerprint is a keyed SHA-256 digest of the value: equal fingerprints within one scope mean equal values, but a workspace secret and its intern copy carry different fingerprints. hosts and fingerprint are null only for legacy rows written before host binding was required; storing the secret again assigns hosts.
Show child attributes
Show child attributes
{
"created_at": "2026-09-15T17:44:00.000Z",
"fingerprint": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"hosts": ["api.github.com"],
"name": "github_token"
}