Provider credentials

Provider credentials let one provider load the authentication material it needs from another SecretSpec provider. They are supported in SecretSpec 0.15 and later.

The table below is the exhaustive reference for accepted semantic credential names for providers compiled into SecretSpec. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, SecretSpec checks them from left to right.

External providers negotiate their URI-specific semantic names through the provider protocol in SecretSpec 0.20+. They do not appear in this compile-time catalog. Their alias may omit credentials; SecretSpec then uses its provider-private operating-system keyring namespace. A configured mapping is a lazy source override for the name the endpoint requests.

Provider	Credential	Environment fallback	Available since
`aac`	`tenant_id`	`AZURE_TENANT_ID`	0.20+
`aac`	`client_id`	`AZURE_CLIENT_ID`	0.20+
`aac`	`client_secret`	`AZURE_CLIENT_SECRET`	0.20+
`aac`	`connection_string`	`AZURE_APPCONFIG_CONNECTION_STRING`	0.20+
`age`	`identity`	`AGE_IDENTITY`	0.17+
`akv`	`tenant_id`	`AZURE_TENANT_ID`	0.15+
`akv`	`client_id`	`AZURE_CLIENT_ID`	0.15+
`akv`	`client_secret`	`AZURE_CLIENT_SECRET`	0.15+
`bws`	`access_token`	`BWS_ACCESS_TOKEN`	0.15+
`dashlane`	`service_device_keys`	`DASHLANE_SERVICE_DEVICE_KEYS`	0.18+
`fly`	`access_token`	`FLY_API_TOKEN` → `FLY_ACCESS_TOKEN`	0.20+
`infisical`	`client_id`	`INFISICAL_CLIENT_ID`	0.16+
`infisical`	`client_secret`	`INFISICAL_CLIENT_SECRET`	0.16+
`infisical`	`token`	`INFISICAL_TOKEN`	0.16+
`kdbx`	`password`	`SECRETSPEC_KDBX_PASSWORD`	0.17+
`keeper`	`config`	`KSM_CONFIG`	0.18+
`keeper`	`token`	`KSM_TOKEN`	0.18+
`onepassword`	`service_account_token`	`OP_SERVICE_ACCOUNT_TOKEN`	0.15+
`openbao`	`role_id`	`BAO_ROLE_ID` → `VAULT_ROLE_ID`	0.17+
`openbao`	`secret_id`	`BAO_SECRET_ID` → `VAULT_SECRET_ID`	0.17+
`openbao`	`token`	`BAO_TOKEN` → `VAULT_TOKEN`	0.17+
`passbolt`	`private_key`	`SECRETSPEC_PASSBOLT_PRIVATE_KEY`	0.19+
`passbolt`	`passphrase`	`SECRETSPEC_PASSBOLT_PASSPHRASE`	0.19+
`scaleway`	`secret_key`	`SCW_SECRET_KEY`	0.17+
`sops`	`age_key`	`SOPS_AGE_KEY`	0.17+
`sops`	`aws_secret_access_key`	`AWS_SECRET_ACCESS_KEY`	0.17+
`sops`	`azure_client_secret`	`AZURE_CLIENT_SECRET`	0.17+
`sops`	`hc_vault_token`	`VAULT_TOKEN`	0.17+
`sops`	`huawei_sdk_ak`	`HUAWEICLOUD_SDK_AK`	0.17+
`sops`	`huawei_sdk_sk`	`HUAWEICLOUD_SDK_SK`	0.17+
`sops`	`google_oauth_access_token`	`GOOGLE_OAUTH_ACCESS_TOKEN`	0.17+
`vault`	`role_id`	`VAULT_ROLE_ID`	0.15+
`vault`	`secret_id`	`VAULT_SECRET_ID`	0.15+
`vault`	`token`	`VAULT_TOKEN`	0.15+

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.