Every sample on every page follows this. Change it any time.

Get a test key
BashBrainTeammatesPricingDevelopersGet a test key

secrets

Store values that Bash uses but never shows, such as your MCP servers' tokens or your users' own credentials. Secrets are write-only: once stored, a secret is never shown again, not even to you.

Store a company secret

Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.

TypeScript
await vestra.secrets.set('TRIPNEST_MCP_TOKEN', process.env.TRIPNEST_MCP_TOKEN!);

Store a user's secret

It is for their own account, as ${user_secret:IRCTC_TOKEN}.

TypeScript
await vestra.user('traveller-42').secrets.set('IRCTC_TOKEN', irctcToken);

List and delete secrets

The list shows names only, never values.

TypeScript
const names = await vestra.secrets.list();console.log(names.data.map((s) => s.name));await vestra.secrets.delete('TRIPNEST_MCP_TOKEN');

Store a company secret

Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.

Python
vestra.secrets.set("TRIPNEST_MCP_TOKEN", os.environ["TRIPNEST_MCP_TOKEN"])

Store a user's secret

It is for their own account, as ${user_secret:IRCTC_TOKEN}.

Python
vestra.user("traveller-42").secrets.set("IRCTC_TOKEN", irctc_token)

List and delete secrets

The list shows names only, never values.

Python
print([s.name for s in vestra.secrets.list().data])vestra.secrets.delete("TRIPNEST_MCP_TOKEN")

Store a company secret

Type the value when asked. From a script, pass --value - with the value on stdin, or --value-from-env <VAR>. The value is never part of the command, where it would stay in your shell history.

CLI
vestra secrets set TRIPNEST_MCP_TOKEN

Store a user's secret

It is for their own account.

CLI
vestra secrets set IRCTC_TOKEN --user traveller-42

List and delete secrets

The list shows names only, never values.

CLI
vestra secretsvestra secrets delete TRIPNEST_MCP_TOKEN

Store a company secret

Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.

HTTP
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }'

Store a user's secret

It is for their own account, as ${user_secret:IRCTC_TOKEN}.

HTTP
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }'

List and delete secrets

The list shows names only, never values.

HTTP
curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"

Only people manage secrets: no MCP tool stores or lists one. Use the console, the CLI or HTTP.

Store a company secret

Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.

HTTP
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }'

Store a user's secret

It is for their own account, as ${user_secret:IRCTC_TOKEN}.

HTTP
curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }'

List and delete secrets

The list shows names only, never values.

HTTP
curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"

Good to know

Company and user secrets

A secret stored without a user belongs to your company. Refer to it as ${secret:NAME}. A secret stored with a user belongs to that user. Refer to it as ${user_secret:NAME}.

Listing secrets

Listing secrets returns their names, never their values.

The key you need

Managing secrets needs a key with the setup scope, or all.

The routes behind secrets3 routes, each with every field in the API reference
PUT/v1/secrets/{name}Store a secret, write-only: the company's (refer to it as ${secret:NAME}), or with user_id one user's own (${user_secret:NAME}), for example their travel account token. Storing it again replaces it.Key scope: setup (or all)
DELETE/v1/secrets/{name}Remove one: the company's, or one user's (user_id).Key scope: setup (or all)
GET/v1/secretsSecret names, never the values: the company's, or one user's (user_id).Key scope: setup (or all)