Skip to main content
PUT
/
v2
/
secrets
/
{path}
Put Secret
curl --request PUT \
  --url https://api.tusky.io/v2/secrets/{path} \
  --header 'Content-Type: application/json' \
  --data '{
  "data": {}
}'
{
  "path": "<string>",
  "version": 123,
  "managed": true,
  "createdAt": "<string>"
}
Create or update a secret at the specified path. Secrets are global to your account. The data is encrypted using Sui Seal — Tusky never has access to the plaintext values.

​
Path Parameters

​
path
string
required
The path to store the secret at. Use / separators for hierarchy (e.g., production/database/password).

​
Request Body

​
data
object
required
Key-value pairs to store. Values are strings.

​
Response

​
path
string
The full path of the stored secret.
​
version
number
Version number. Increments on each update.
​
managed
boolean
false for user-created secrets.
​
createdAt
string
ISO 8601 timestamp.

​
Example

curl -X PUT https://api.tusky.io/v2/secrets/production/database \
  -H "Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "host": "db.example.com",
      "port": "5432",
      "username": "app_user",
      "password": "s3cur3_p4ssw0rd"
    }
  }'

​
Response

{
  "path": "production/database",
  "version": 1,
  "managed": false,
  "createdAt": "2026-03-06T14:00:00Z"
}
Secrets are encrypted client-side using Sui Seal. Access is controlled by on-chain policies.
You cannot write to paths under tusky/ — these are reserved for managed secrets created automatically by Tusky (e.g., encryption keys for private environments).