Create or update a secret for the authenticated user

Creates or updates a secret for a user's codespace with an encrypted value. Encrypt your secret using
LibSodium.

You must authenticate using an access token with the codespace or codespace:secrets scope to use this endpoint. User must also have Codespaces access to use this endpoint.

GitHub Apps must have write access to the codespaces_user_secrets user permission and codespaces_secrets repository permission on all referenced repositories to use this endpoint.

Example encrypting a secret using Node.js

Encrypt your secret using the libsodium-wrappers library.

Example encrypting a secret using Python

Encrypt your secret using pynacl with Python 3.

from base64 import b64encode
from nacl import encoding, public

def encrypt(public_key: str, secret_value: str) -> str:
  """Encrypt a Unicode string using the public key."""
  public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
  sealed_box = public.SealedBox(public_key)
  encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
  return b64encode(encrypted).decode("utf-8")

Example encrypting a secret using C#

Encrypt your secret using the Sodium.Core package.

var secretValue = System.Text.Encoding.UTF8.GetBytes("mySecret");
var publicKey = Convert.FromBase64String("2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvvcCU=");

var sealedPublicKeyBox = Sodium.SealedPublicKeyBox.Create(secretValue, publicKey);

Console.WriteLine(Convert.ToBase64String(sealedPublicKeyBox));

Example encrypting a secret using Ruby

Encrypt your secret using the rbnacl gem.

curl --location --request PUT 'https://api.github.com/user/codespaces/secrets/' \ --header 'Content-Type: application/json' \ --data-raw '{ "encrypted_value": "c2VjcmV0", "key_id": "012345678912345678", "selected_repository_ids": [ "1234567", "2345678" ] }'

Request

Path Params

secret_name

string

required

The name of the secret.

Body Params application/json

encrypted_value

string

optional

Value for your secret, encrypted with LibSodium using the public key retrieved from the Get the public key for the authenticated user endpoint.

Match pattern:

^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$

key_id

string

required

ID of the key you used to encrypt the secret.

selected_repository_ids

array [anyOf]

optional

An array of repository ids that can access the user secret. You can manage the list of selected repositories using the List selected repositories for a user secret, Set selected repositories for a user secret, and Remove a selected repository from a user secret endpoints.

integer

optional

string

optional

Examples

Create or update a secret for the authenticated user

Example encrypting a secret using Node.js#

Example encrypting a secret using Python#

Example encrypting a secret using C##

Example encrypting a secret using Ruby#

Request

Responses

Example encrypting a secret using Node.js

Example encrypting a secret using Python

Example encrypting a secret using C#

Example encrypting a secret using Ruby