opschain admin secrets providers create

Included from Basic tiersecrets:multi-vaultpacks:secrets-awspacks:secrets-azure

Registers a secrets provider. The code (the estate identifier the provider is addressed by) and the kind are immutable after create; everything else can change through the update verb. The auth credential — the token, the userpass password or the approle secret id, per --auth-method — is write-only: supply it through --credential-env (the name of an environment variable holding it) or --credential-prompt (a no-echo prompt), never on the command line; it is encrypted at rest and no read ever returns it.

The base platform is single-vault: creating a provider with --enabled (the default) while another enabled provider exists is refused with the typed SECRETS_PROVIDER_SINGLE_DEFAULT error naming the enabled one — disable it first, or create this one with --enabled=false.

OPSCHAIN_VAULT_CRED=s.xxxx opschain admin secrets providers create vault \
  --kind openbao --address https://bao.corp:8200 --mount-path secrets \
  --credential-env OPSCHAIN_VAULT_CRED
Created secrets provider vault (kind openbao, https://bao.corp:8200) — run 'opschain admin secrets providers test vault'

An AWS Secrets Manager provider (requires the packs:secrets-aws entitlement — see opschain docs packs-secrets-aws) takes the region and an IAM access key pair instead of a vault address; the access key id rides --username and the secret access key rides the credential flags:

AWS_SECRET=... opschain admin secrets providers create aws-payments \
  --kind aws-secrets-manager --region ap-southeast-2 \
  --username AKIA... --credential-env AWS_SECRET

An Azure Key Vault provider (requires the packs:secrets-azure entitlement — see opschain docs packs-secrets-azure) takes the vault URL, the Entra ID tenant and an app registration's client credentials; the client id rides --username and the client secret rides the credential flags:

AZ_SECRET=... opschain admin secrets providers create azure-payments \
  --kind azure-key-vault --address https://payments.vault.azure.net \
  --tenant-id <tenant-guid> --username <client-id> --credential-env AZ_SECRET

-o, --output json|yaml emits the created provider document.

Reference custody

A secrets provider's own credential may be pinned as a provider-qualified secret-vault://<code>@<path>/<key> reference. The reference must name ANOTHER enabled secrets provider and resolve at write time - a vault cannot custody its own key, so unqualified and self-qualified references refuse by name. An inline credential stays encrypted at rest on the record (vault-write sugar would store the vault's own key inside a vault); records keep their inline credential until a reference is pinned, which clears it.

Flags

Flag	Meaning
--kind <kind>	Backend kind: openbao, hashicorp-vault, aws-secrets-manager or azure-key-vault (immutable; each cloud kind requires its packs:secrets-<cloud> entitlement).
--display-name <name>	Human name the GUI renders.
--kv-version <1|2>	KV secrets-engine version. Default 1.
--address <url>	Vault endpoint URL (azure-key-vault: the vault URL, required; aws-secrets-manager: an optional endpoint-URL override — empty derives it from the region).
--region <region>	AWS region (aws-secrets-manager kind only, e.g. ap-southeast-2).
--tenant-id <guid>	Microsoft Entra ID tenant id (azure-key-vault kind only).
--auth-method <method>	token (default), userpass or approle (vault kinds); access-key (aws-secrets-manager, its default); client-secret (azure-key-vault, its default).
--username <name>	Userpass username, the IAM access key id (access-key auth), or the Entra ID application (client) id (client-secret auth).
--role-id <id>	AppRole role id (the secret id rides the credential flags).
--credential-ref <ref>	Provider-qualified secret-vault://<code>@<path>/<key> reference to pin - it must name another enabled secrets provider (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the credential without echo.
--mount-path <path>	KV secrets-engine mount path (empty: the engine default); for the cloud kinds, an optional secret-name prefix.
--ssl-verify	Verify the vault's TLS certificate (default true; --ssl-verify=false is an explicit opt-out for self-signed endpoints).
--ssl-ca-cert <path>	CA certificate file path trusted for the vault connection.
--cipher-stacking	Cipher-stack values written through /api/secrets/store (default true).
--password-length <n>	Length of server-generated secret values (0: the endpoint default).
--enabled	Whether the provider is the estate's enabled default (default true; without secrets:multi-vault: at most one).
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-secrets-providers-update — rotate the credential.