Skip to main content
POST
Write a secret env value and its manifest !ENV marker together, then reload

Authorizations

x-api-key
string
header
required

Body

application/json

The combined env+manifest secret op body (POST /api/mcp-config/secret-env).

value is the raw secret pasted by the operator. The env KEY it is stored under is EITHER an explicit key OR generated from key_hint — exactly one is given ({value, key | key_hint, manifest_pointer}). The server writes value to the env store under that key (marked secret) and writes an !ENV ${KEY} MARKER at manifest_pointer — so the secret lives only in the env store and the manifest carries a placeholder. An explicit key that collides with an existing stored key holding a DIFFERENT value is refused with a loud 400 naming the key (never a silent overwrite of a live secret). manifest_pointer is a slash-delimited, no-leading-slash path (e.g. mcp/0/config/headers/Authorization) whose HEAD segment MUST be mcp (the same mcp-only authority set_mcp_config holds). The generated key is NOT returned.

manifest_pointer
string
required
value
string
required
key
string | null
key_hint
string | null

Response

Success.

data
ApplyResponse · object
required

The standard mutation-op response: this worker's local reload result merged with the fleet fan-out summary. env_keys is the count of env keys the reload loaded.