Provider credentials

Provider credentials let one provider load the authentication material it needs from another SecretSpec provider. They are supported in SecretSpec 0.15 and later.

The table below is the exhaustive reference for accepted semantic credential names. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, SecretSpec checks them from left to right. A configured credential that resolves to an empty value is an error; SecretSpec never substitutes the environment fallback for it (0.21+).

Provider	Credential	Environment fallback	Available since
`aac`	`tenant_id`	`AZURE_TENANT_ID`	0.20+
`aac`	`client_id`	`AZURE_CLIENT_ID`	0.20+
`aac`	`client_secret`	`AZURE_CLIENT_SECRET`	0.20+
`aac`	`connection_string`	`AZURE_APPCONFIG_CONNECTION_STRING`	0.20+
`age`	`identity`	`AGE_IDENTITY`	0.17+
`akv`	`tenant_id`	`AZURE_TENANT_ID`	0.15+
`akv`	`client_id`	`AZURE_CLIENT_ID`	0.15+
`akv`	`client_secret`	`AZURE_CLIENT_SECRET`	0.15+
`bws`	`access_token`	`BWS_ACCESS_TOKEN`	0.15+
`cloudflare`	`api_token`	`CLOUDFLARE_API_TOKEN`	0.20+
`dashlane`	`service_device_keys`	`DASHLANE_SERVICE_DEVICE_KEYS`	0.18+
`doppler`	`token`	`DOPPLER_TOKEN`	0.21+
`ejson`	`private_key`	—	0.20+
`fly`	`access_token`	`FLY_API_TOKEN` → `FLY_ACCESS_TOKEN`	0.20+
`infisical`	`client_id`	`INFISICAL_CLIENT_ID`	0.16+
`infisical`	`client_secret`	`INFISICAL_CLIENT_SECRET`	0.16+
`infisical`	`token`	`INFISICAL_TOKEN`	0.16+
`kdbx`	`password`	`SECRETSPEC_KDBX_PASSWORD`	0.17+
`keeper`	`config`	`KSM_CONFIG`	0.18+
`keeper`	`token`	`KSM_TOKEN`	0.18+
`onepassword`	`service_account_token`	`OP_SERVICE_ACCOUNT_TOKEN`	0.15+
`openbao`	`role_id`	`BAO_ROLE_ID` → `VAULT_ROLE_ID`	0.17+
`openbao`	`secret_id`	`BAO_SECRET_ID` → `VAULT_SECRET_ID`	0.17+
`openbao`	`token`	`BAO_TOKEN` → `VAULT_TOKEN`	0.17+
`passbolt`	`private_key`	`SECRETSPEC_PASSBOLT_PRIVATE_KEY`	0.19+
`passbolt`	`passphrase`	`SECRETSPEC_PASSBOLT_PASSPHRASE`	0.19+
`scaleway`	`secret_key`	`SCW_SECRET_KEY`	0.17+
`sops`	`age_key`	`SOPS_AGE_KEY`	0.17+
`sops`	`aws_secret_access_key`	`AWS_SECRET_ACCESS_KEY`	0.17+
`sops`	`azure_client_secret`	`AZURE_CLIENT_SECRET`	0.17+
`sops`	`hc_vault_token`	`VAULT_TOKEN`	0.17+
`sops`	`huawei_sdk_ak`	`HUAWEICLOUD_SDK_AK`	0.17+
`sops`	`huawei_sdk_sk`	`HUAWEICLOUD_SDK_SK`	0.17+
`sops`	`google_oauth_access_token`	`GOOGLE_OAUTH_ACCESS_TOKEN`	0.17+
`vault`	`role_id`	`VAULT_ROLE_ID`	0.15+
`vault`	`secret_id`	`VAULT_SECRET_ID`	0.15+
`vault`	`token`	`VAULT_TOKEN`	0.15+

In 0.21+, credentials retain their exact bytes during resolution. Interfaces that require text validate UTF-8 when consuming the credential; invalid input returns an error without selecting an environment fallback. Unix CLI environments accept non-UTF-8 bytes, but cannot contain NUL bytes. A configured credential that resolves to an empty value is an error rather than a fall through to the environment.

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.