2 min read

Provider credentials

Provider credentials let one provider load the authentication material it needs from another SecretSpec provider. They are supported in SecretSpec 0.15 and later.

The table below is the exhaustive reference for accepted semantic credential names. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, SecretSpec checks them from left to right.

Provider	Credential	Environment fallback	Available since
`aac`	`tenant_id`	`AZURE_TENANT_ID`	0.20+
`aac`	`client_id`	`AZURE_CLIENT_ID`	0.20+
`aac`	`client_secret`	`AZURE_CLIENT_SECRET`	0.20+
`aac`	`connection_string`	`AZURE_APPCONFIG_CONNECTION_STRING`	0.20+
`age`	`identity`	`AGE_IDENTITY`	0.17+
`akv`	`tenant_id`	`AZURE_TENANT_ID`	0.15+
`akv`	`client_id`	`AZURE_CLIENT_ID`	0.15+
`akv`	`client_secret`	`AZURE_CLIENT_SECRET`	0.15+
`bws`	`access_token`	`BWS_ACCESS_TOKEN`	0.15+
`cloudflare`	`api_token`	`CLOUDFLARE_API_TOKEN`	0.20+
`dashlane`	`service_device_keys`	`DASHLANE_SERVICE_DEVICE_KEYS`	0.18+
`ejson`	`private_key`	—	0.20+
`fly`	`access_token`	`FLY_API_TOKEN` → `FLY_ACCESS_TOKEN`	0.20+
`infisical`	`client_id`	`INFISICAL_CLIENT_ID`	0.16+
`infisical`	`client_secret`	`INFISICAL_CLIENT_SECRET`	0.16+
`infisical`	`token`	`INFISICAL_TOKEN`	0.16+
`kdbx`	`password`	`SECRETSPEC_KDBX_PASSWORD`	0.17+
`keeper`	`config`	`KSM_CONFIG`	0.18+
`keeper`	`token`	`KSM_TOKEN`	0.18+
`onepassword`	`service_account_token`	`OP_SERVICE_ACCOUNT_TOKEN`	0.15+
`openbao`	`role_id`	`BAO_ROLE_ID` → `VAULT_ROLE_ID`	0.17+
`openbao`	`secret_id`	`BAO_SECRET_ID` → `VAULT_SECRET_ID`	0.17+
`openbao`	`token`	`BAO_TOKEN` → `VAULT_TOKEN`	0.17+
`passbolt`	`private_key`	`SECRETSPEC_PASSBOLT_PRIVATE_KEY`	0.19+
`passbolt`	`passphrase`	`SECRETSPEC_PASSBOLT_PASSPHRASE`	0.19+
`scaleway`	`secret_key`	`SCW_SECRET_KEY`	0.17+
`sops`	`age_key`	`SOPS_AGE_KEY`	0.17+
`sops`	`aws_secret_access_key`	`AWS_SECRET_ACCESS_KEY`	0.17+
`sops`	`azure_client_secret`	`AZURE_CLIENT_SECRET`	0.17+
`sops`	`hc_vault_token`	`VAULT_TOKEN`	0.17+
`sops`	`huawei_sdk_ak`	`HUAWEICLOUD_SDK_AK`	0.17+
`sops`	`huawei_sdk_sk`	`HUAWEICLOUD_SDK_SK`	0.17+
`sops`	`google_oauth_access_token`	`GOOGLE_OAUTH_ACCESS_TOKEN`	0.17+
`vault`	`role_id`	`VAULT_ROLE_ID`	0.15+
`vault`	`secret_id`	`VAULT_SECRET_ID`	0.15+
`vault`	`token`	`VAULT_TOKEN`	0.15+

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.

Last updated Oct 08, 2026