Create or update workspace secret

This page documents the canonical HTTP contract for this endpoint.

Authentication: use a scoped developer API key or a valid session token.

Secret names must start with a letter, contain only letters, numbers, and underscores, and be at most 64 characters. Names are trimmed and normalized to lowercase. Values are trimmed and must contain at least three characters afterward. Unknown request fields are rejected with 422.

If a secret with the same name already exists, its value is updated in place.

Once stored, reference the secret in HTTP Request columns with {{secrets.name}} in URL paths/query, headers, or body templates. Requests using secrets require a literal HTTPS origin; secrets cannot be placed in the host.

Body parameters

namerequired
string
Secret name. Must start with a letter, only letters/numbers/underscores, max 64 chars.
valuerequired
string
Secret value (API key, token, etc). Min 3 characters.

Name	Type	Description
namerequired	string	Secret name. Must start with a letter, only letters/numbers/underscores, max 64 chars.
valuerequired	string	Secret value (API key, token, etc). Min 3 characters.

Errors

Status	Meaning
422	Invalid request, name, or value.
400	Missing authenticated user email, user ID, or organization context.
401	Missing or invalid authentication.
403	Access denied.

Example

bash

curl -X POST "https://app.autotouch.ai/api/workspace-secrets" \
    -H "Authorization: Bearer stk_your_key_id.your_secret" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "openai_api_key",
      "value": "sk-proj-abc123..."
    }'

Request body

json

{
    "name": "openai_api_key",
    "value": "sk-proj-abc123..."
  }

Response example

json

{
    "name": "openai_api_key",
    "masked_value": "sk-p...23..",
    "template_reference": "{{secrets.openai_api_key}}",
    "created_at": "2026-03-12T10:00:00",
    "updated_at": "2026-03-12T10:00:00"
  }