MCP servers and secrets

Your MCP servers and the tools they offer, and the secrets Bash uses but never shows.

Send Authorization: Bearer vk_test_... on every call. Every route of MCP servers and secrets.

PUT/v1/secrets/{name}Store a secret, write-only: the company's (refer to it as ${secret:NAME}), or with user_id one user's own (${user_secret:NAME}), for example their travel account token.

Storing it again replaces it.

Your API key, scope setup or all. On the card: secrets. Every call here is a checked sample.

Request3 fields

Path

namestringrequiredThe secret's name: capitals, digits and underscores, starting with a capital.

Type: string

Body

user_idstringWhose secret: your id for the user, for their own (read as ${user_secret:NAME}). Absent: your company's (read as ${secret:NAME}).

Example: traveller-42

valuestringrequiredThe secret itself, up to 8,192 characters. It is write-only: no call ever returns it.

Limits: 1 to 8192 characters.

Answers 2004 fields

object"secret"Always secret.

Type: "secret"

namestringThe secret's name.

Example: PNR_API_KEY

user_idstring | nullYour id for the user whose secret it is; null for your company's.

Type: string | null

mode"live" | "test"The mode it is kept in: a live key reads live secrets, a test key test ones.

Type: "live" | "test"

TypeScript

await vestra.secrets.set('TRIPNEST_MCP_TOKEN', process.env.TRIPNEST_MCP_TOKEN!);

Python

vestra.secrets.set("TRIPNEST_MCP_TOKEN", os.environ["TRIPNEST_MCP_TOKEN"])

CLI

vestra secrets set TRIPNEST_MCP_TOKEN

HTTP

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"

HTTP

No sample in your language for this route, so here it is over HTTP.

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"