Provider credentials

Provider credentials let one provider load the authentication material it needs from another Monosecret provider. They are supported in Monosecret 0.2 and later.

The table below is the exhaustive reference for accepted semantic credential names. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, Monosecret checks them from left to right.

Provider	Credential	Environment fallback	Available since
aac	tenant_id	AZURE_TENANT_ID	0.20+
aac	client_id	AZURE_CLIENT_ID	0.20+
aac	client_secret	AZURE_CLIENT_SECRET	0.20+
aac	connection_string	AZURE_APPCONFIG_CONNECTION_STRING	0.20+
age	identity	AGE_IDENTITY	0.2+
akv	tenant_id	AZURE_TENANT_ID	0.2+
akv	client_id	AZURE_CLIENT_ID	0.2+
akv	client_secret	AZURE_CLIENT_SECRET	0.2+
bws	access_token	BWS_ACCESS_TOKEN	0.2+
cloudflare	api_token	CLOUDFLARE_API_TOKEN	0.20+
dashlane	service_device_keys	DASHLANE_SERVICE_DEVICE_KEYS	0.2+
ejson	private_key	—	0.20+
fly	access_token	FLY_API_TOKEN → FLY_ACCESS_TOKEN	0.20+
infisical	client_id	INFISICAL_CLIENT_ID	0.2+
infisical	client_secret	INFISICAL_CLIENT_SECRET	0.2+
infisical	token	INFISICAL_TOKEN	0.2+
kdbx	password	MONOSECRET_KDBX_PASSWORD	0.2+
keeper	config	KSM_CONFIG	0.2+
keeper	token	KSM_TOKEN	0.2+
onepassword	service_account_token	OP_SERVICE_ACCOUNT_TOKEN	0.2+
openbao	role_id	BAO_ROLE_ID → VAULT_ROLE_ID	0.2+
openbao	secret_id	BAO_SECRET_ID → VAULT_SECRET_ID	0.2+
openbao	token	BAO_TOKEN → VAULT_TOKEN	0.2+
passbolt	private_key	MONOSECRET_PASSBOLT_PRIVATE_KEY	0.2+
passbolt	passphrase	MONOSECRET_PASSBOLT_PASSPHRASE	0.2+
scaleway	secret_key	SCW_SECRET_KEY	0.2+
sops	age_key	SOPS_AGE_KEY	0.2+
sops	aws_secret_access_key	AWS_SECRET_ACCESS_KEY	0.2+
sops	azure_client_secret	AZURE_CLIENT_SECRET	0.2+
sops	hc_vault_token	VAULT_TOKEN	0.2+
sops	huawei_sdk_ak	HUAWEICLOUD_SDK_AK	0.2+
sops	huawei_sdk_sk	HUAWEICLOUD_SDK_SK	0.2+
sops	google_oauth_access_token	GOOGLE_OAUTH_ACCESS_TOKEN	0.2+
vault	role_id	VAULT_ROLE_ID	0.2+
vault	secret_id	VAULT_SECRET_ID	0.2+
vault	token	VAULT_TOKEN	0.2+

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.