Provider credentials

Provider credentials let one provider load the authentication material it needs from another Monosecret provider. They are supported in Monosecret 0.2 and later.

The table below is the exhaustive reference for accepted semantic credential names for providers compiled into Monosecret. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, Monosecret checks them from left to right. A configured credential that resolves to an empty value is an error; Monosecret never substitutes the environment fallback for it (0.4.0+).

External providers negotiate their URI-specific semantic names through the Secret Provider Protocol in Monosecret 0.4.0+. They do not appear in this compile-time catalog. Their alias may omit credentials; Monosecret then uses its provider-private operating-system keyring namespace. A configured mapping is a lazy source override for the name the endpoint requests. See the IPC architecture for the boundary and IPC wire format for its messages.

Provider	Credential	Environment fallback	Available since
aac	tenant_id	AZURE_TENANT_ID	0.20+
aac	client_id	AZURE_CLIENT_ID	0.20+
aac	client_secret	AZURE_CLIENT_SECRET	0.20+
aac	connection_string	AZURE_APPCONFIG_CONNECTION_STRING	0.20+
age	identity	AGE_IDENTITY	0.2+
akv	tenant_id	AZURE_TENANT_ID	0.2+
akv	client_id	AZURE_CLIENT_ID	0.2+
akv	client_secret	AZURE_CLIENT_SECRET	0.2+
bws	access_token	BWS_ACCESS_TOKEN	0.2+
cloudflare	api_token	CLOUDFLARE_API_TOKEN	0.20+
convex	token	CONVEX_DEPLOY_KEY → CONVEX_DEPLOYMENT_TOKEN	0.4+
dashlane	service_device_keys	DASHLANE_SERVICE_DEVICE_KEYS	0.2+
digitalocean	token	DIGITALOCEAN_ACCESS_TOKEN → DIGITALOCEAN_TOKEN	0.4+
doppler	token	DOPPLER_TOKEN	0.4+
ejson	private_key	—	0.20+
fly	access_token	FLY_API_TOKEN → FLY_ACCESS_TOKEN	0.20+
infisical	client_id	INFISICAL_CLIENT_ID	0.2+
infisical	client_secret	INFISICAL_CLIENT_SECRET	0.2+
infisical	token	INFISICAL_TOKEN	0.2+
kdbx	password	MONOSECRET_KDBX_PASSWORD	0.2+
keeper	config	KSM_CONFIG	0.2+
keeper	token	KSM_TOKEN	0.2+
netlify	token	NETLIFY_AUTH_TOKEN	0.4+
onepassword	service_account_token	OP_SERVICE_ACCOUNT_TOKEN	0.2+
openbao	role_id	BAO_ROLE_ID → VAULT_ROLE_ID	0.2+
openbao	secret_id	BAO_SECRET_ID → VAULT_SECRET_ID	0.2+
openbao	token	BAO_TOKEN → VAULT_TOKEN	0.2+
passbolt	private_key	MONOSECRET_PASSBOLT_PRIVATE_KEY	0.2+
passbolt	passphrase	MONOSECRET_PASSBOLT_PASSPHRASE	0.2+
pulumi	token	PULUMI_ACCESS_TOKEN	0.4+
railway	token	RAILWAY_API_TOKEN → RAILWAY_TOKEN	0.4+
scaleway	secret_key	SCW_SECRET_KEY	0.2+
sops	age_key	SOPS_AGE_KEY	0.2+
sops	aws_secret_access_key	AWS_SECRET_ACCESS_KEY	0.2+
sops	azure_client_secret	AZURE_CLIENT_SECRET	0.2+
sops	hc_vault_token	VAULT_TOKEN	0.2+
sops	huawei_sdk_ak	HUAWEICLOUD_SDK_AK	0.2+
sops	huawei_sdk_sk	HUAWEICLOUD_SDK_SK	0.2+
sops	google_oauth_access_token	GOOGLE_OAUTH_ACCESS_TOKEN	0.2+
vault	role_id	VAULT_ROLE_ID	0.2+
vault	secret_id	VAULT_SECRET_ID	0.2+
vault	token	VAULT_TOKEN	0.2+
vercel	token	VERCEL_TOKEN → VERCEL_ACCESS_TOKEN	0.4+

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.