MCP servers and secrets

Your MCP servers and the tools they offer, and the secrets Bash uses but never shows.

Send Authorization: Bearer vk_test_... on every call. Every route of MCP servers and secrets.

GET/v1/secretsSecret names, never the values: the company's, or one user's (user_id).

Your API key, scope setup or all. On the card: secrets. Every call here is a checked sample.

Request3 fields

Query

limitintegerHow many items per page, 1 to 100. Default 20.

Type: integer

cursorstringWhere to go on from: the next_cursor of the page before, unchanged. Absent: the first page.

Type: string

user_idstringWhose secret: your id for the user, for their own (read as ${user_secret:NAME}). Absent: your company's (read as ${secret:NAME}).

Type: string

Answers 2002 fields

dataobject[]The items on this page.

object"secret"Always secret.

Type: "secret"

namestringThe secret's name.

Example: PNR_API_KEY

user_idstring | nullYour id for the user whose secret it is; null for your company's.

Type: string | null

mode"live" | "test"The mode it is kept in: a live key reads live secrets, a test key test ones.

Type: "live" | "test"

next_cursorstring | nullSend it as cursor for the next page; null on the last page.

Type: string | null

TypeScript

const secrets = await vestra.secrets.list();

Python

secrets = vestra.secrets.list()

CLI

vestra secrets

HTTP

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"

HTTP

No sample in your language for this route, so here it is over HTTP.

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"