opschain admin transport-providers create

packs:rpc

Registers a transport provider. The code and the kind are immutable after create; everything else can change through the update verb. Creating a provider requires the packs:rpc entitlement — the typed FEATURE_ENTITLEMENT_REQUIRED refusal names it.

The credential rides exactly one of two channels, and the record only ever stores a reference:

• --credential-ref secret-vault://<path>/<key> pins an existing vault reference. The reference is resolved as it is set — pinning a reference that does not resolve refuses by name — so a record can never point at a dangling or foreign address. A provider-qualified reference (secret-vault://<provider>@<path>/<key>) must name an enabled secrets provider and keeps the key in that customer vault.
• --credential-env / --credential-prompt supply an inline credential (an SSH private key or a password — never on the command line). The server holds it encrypted at rest on the record itself (never in a vault; credential_ref stays empty), so a server with no secrets provider registered still dials with it.

SSH_KEY=$(cat ~/.ssh/deploy_key) opschain admin transport-providers create prod-ssh \
  --config '{"username":"deploy"}' --credential-env SSH_KEY
Created transport provider prod-ssh (credential_ref secret-vault://transport-providers/prod-ssh/credential)

opschain admin transport-providers create prod-ssh \
  --config '{"username":"deploy"}' \
  --credential-ref secret-vault://customer-vault@infra/prod/ssh_key

The ssh-static config object carries connection facts only: username, auth_method (key, the default — the referenced credential is an SSH private key — or password), port (1–65535; 0 or absent means the ssh default) and connect_timeout_seconds. Unknown keys refuse — credential material never belongs in config.

The ssh-ca config adds the minted certificate's policy to the same connection facts: principals (who the short-lived certificate is valid for; or username alone as the single principal — one of the two is required), validity_seconds (1–86400; 0 or absent means 300, the short-lived default), port and connect_timeout_seconds. The credential channel carries the CA signing key; the key never leaves the platform — sessions receive a freshly-signed certificate instead.

CA_KEY=$(cat ~/.ssh/opschain_ca) opschain admin transport-providers create prod-ssh-ca \
  --kind ssh-ca --config '{"username":"deploy","validity_seconds":600}' --credential-env CA_KEY

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--kind <kind>	Provider kind: ssh-static or ssh-ca. Immutable after create.
--display-name <name>	Human-readable provider name.
--config <json>	Kind-specific config as a JSON object (see above).
--credential-ref <ref>	secret-vault:// reference to pin (mutually exclusive with the inline channel).
--enabled	Whether dispatch resolves sessions through the provider (default true).
--credential-env <name>	Environment variable holding the inline credential (never the value itself on argv).
--credential-prompt	Prompt for the inline credential without echo.

See also

• opschain docs cli/admin-transport-providers-test — validating the record.
• opschain docs cli/admin-secrets-providers — the vaults references resolve through.