Store credentials

A bucket is the credential container an SDK, MCP server, or service points at. Services declare what is enabled; buckets hold what a running app actually uses. Secrets are resolved server-side by Fused at dispatch time. They never appear in a config file, a plan receipt, or a generated package.

Use managed auth or your own credentials

For a supported OAuth service, you can use a Managed service instead of creating and storing a provider client pair. Fused holds the application’s client secret; your selected bucket still owns the encrypted user connections. Use the steps below for your own provider application or other authentication schemes.

One app, different buckets per service

An SDK or MCP server declares one default bucket: at the top level. Any service may override it with its own bucket:, so a single app can route different services’ credentials through different buckets:

apiVersion: fused/v1
kind: sdk
bucket: default
services:
  linear:
    version: "v1"
    select_all: true
  slack:
    version: "v1"
    bucket: slack-credentials
    select_all: true

A service without its own bucket: resolves through the app’s top-level default. A local ${bucket.auth...} reference joins services in the same bucket. A managed ${fused.bucket.auth...} reference selects Fused’s broker application. Webhook signing-secret references explicitly name their bucket independently of the app.

Pick a bucket before you write to one

fused-cli bucket list
fused-cli bucket show default
fused-cli bucket services default

A listed bucket is one you can see, not necessarily one you may use. Choose a visible candidate, run the action you intended, and let the permission check decide. If it is denied, stop and report it — do not create a fallback bucket. Create one only when you actually need isolation:

fused-cli bucket create prod-credentials

A buckets: block in workspace.yaml configures an existing bucket. It cannot create one. If no bucket of that name exists, apply fails with “bucket not found” rather than creating it. bucket create is the only way.

Set up or edit provider credentials

Run connect with the service name. --bucket defaults to default; pass another bucket name or UUID when needed.

fused-cli connect stripe
fused-cli connect stripe --bucket prod-credentials

The picker shows each authentication method and its stored status:

Status	What you can do
✓ Configured · edit	Select it to replace its values
Not configured · set up	Supply the method’s required fields
Expired · set up	Replace credentials whose expiry has passed
Incomplete · set up	Supply the complete credential pair

The picker also appears when only one method matches or when you supply values. It uses metadata only: existing secrets are never displayed or prefilled. Secret entry is masked, and cancelling leaves credentials unchanged.

Supply values for automation

Pass one quoted "name=value, name=value" argument and --no-input. Your shell can expand environment variables inside the argument. A single-value method uses its exact authentication scheme name, which you can inspect with fused-cli service show --registry stripe --json:

fused-cli connect stripe "<auth-name>=$STRIPE_KEY" \
  --auth-name <auth-name> --no-input

Paired methods use their field names in the same argument:

fused-cli connect jira "username=$USERNAME, password=$PASSWORD" \
  --type basic --no-input
fused-cli connect acme "cert=$CERT_PEM, key=$KEY_PEM" \
  --type mtls --no-input
fused-cli connect jira "client_id=$CLIENT_ID, client_secret=$CLIENT_SECRET" \
  --type oauth --auth-name JiraOAuth --no-input

Commas separate fields, and spaces before field names are optional. Values retain embedded = and ; characters. Use interactive setup when a value contains a literal comma. Supply both members of a credential pair together; Basic methods that allow an empty password accept password=. With --no-input, CI, or --json, a sole matching method is selected automatically. If several methods match, narrow the selection with --type or --auth-name. Supplied field names do not infer an authentication type. Without those non-interactive modes, the picker remains available even when you pass values.

Saving through connect takes effect immediately, with no plan or apply step. Selecting a configured method or supplying new values replaces its credentials. In non-interactive mode, omitting values reports an already configured method’s status; missing credentials require explicit input.

`connect` flags

Flag	What it does
`--bucket`	Selects a bucket by name or UUID; defaults to `default`
`--type`	Filters by authentication family, such as `api_key`, `bearer`, `basic`, `oauth`, `oidc`, or `mtls`
`--auth-name`	Selects the exact scheme, including when several schemes share a family
`--expires-at`	Sets an optional expiry in RFC3339 format; Engine rejects expired stored secrets at runtime
`--no-input`	Disables prompts for automation
`--json`	Prints status and authentication metadata without prompting or exposing values

When a stored secret’s expiry has passed, Engine blocks requests that require it before contacting the provider. Expiry does not rotate credentials automatically. The picker marks expired credentials so you can replace them with fused-cli connect <service> --bucket <bucket>.

Store named secrets, environment values, and certificates

Use bucket secret, bucket env, or bucket cert for named entries that belong to the bucket rather than a provider authentication scheme. Each supports set, get, and remove; --bucket defaults to default.

# Omit the value to enter it interactively.
fused-cli bucket secret set webhook_signing

# Pass assignments for automation. Multiple bucket entries use separate arguments.
fused-cli bucket secret set "webhook_signing=$WEBHOOK_SECRET" --no-input
fused-cli bucket env set REGION=eu "API_URL=$API_URL" --no-input
fused-cli bucket cert set "root=$ROOT_CERT_PEM" --no-input

fused-cli bucket env get REGION --bucket prod-credentials
fused-cli bucket cert get root
fused-cli bucket env remove REGION
fused-cli bucket cert remove root
fused-cli bucket secret remove webhook_signing

set splits each assignment at its first = and preserves the rest of the value. Environment values can be explicitly empty (NAME=). Certificates accept public X.509 PEM certificates or chains; private keys belong to a provider’s mTLS credential pair through connect. Environment entries are non-secret bucket-wide values. A service-specific value with the same key takes precedence. A shell variable such as $API_URL supplies its current local value at command invocation; the saved bucket entry is a value, not a reference to that shell variable.

Inspect or retrieve secrets

fused-cli bucket secret list default --json
fused-cli bucket secret set "webhook_signing=$WEBHOOK_SECRET" --exportable --no-input
fused-cli bucket secret get webhook_signing

list returns metadata only. Generic secret get uses the audited retrieval endpoint and requires both export opt-in and credentials.reveal. It never enables retrieval automatically. Generic secret writes also support --expires-at. For an API key stored by connect, use its opaque metadata ID to opt into retrieval:

fused-cli bucket secret exportable default <secret-id> --enabled=true
fused-cli bucket secret reveal default <secret-id>

OAuth/OIDC pairs, bearer tokens, Basic pairs, and mTLS credentials cannot opt into plaintext retrieval. Replacing an API key through connect resets its export policy to disabled.

Store a non-secret value

Some providers need a non-secret piece of configuration, like a tenant ID that appears in the host name. bucket value set takes five positional arguments, and only the third comes from a fixed set:

fused-cli bucket value set <bucket-name-or-id> <service-slug> <location> <key-name> <value>
fused-cli bucket value delete <bucket-name-or-id> <service-slug> <key-name>
fused-cli bucket value list <bucket-name-or-id>

Position	Is	Example
`<bucket-name-or-id>`	Yours	`sendbird-bucket`
`<service-slug>`	The service this value belongs to	`sendbird`
`<location>`	One of `env`, `body`, `query`, `header`, `path`	`env`
`<key-name>`	Yours	`SENDBIRD_APP_ID`
`<value>`	The value itself	`your-app-id`

fused-cli bucket value set sendbird-bucket sendbird env SENDBIRD_APP_ID your-app-id
fused-cli bucket value list sendbird-bucket
fused-cli bucket value delete sendbird-bucket sendbird SENDBIRD_APP_ID

The env namespace here is the bucket’s own value store — it does not read an operating-system environment variable.

Inject a bucket value into a request

An SDK or MCP service can pull those values into the outgoing request at dispatch time, so a tenant ID or account prefix never has to be hardcoded per environment. Usually you will not write these by hand — fused-cli init generates them for whichever server-template variables your selected operations declare, leaving you to supply the value.

services:
  sendbird:
    version: "v3"
    operations: [listChannels]
    injections:
      - location: server_variable
        name: app_id
        value: ${bucket.env.SENDBIRD_APP_ID}
        mode: force

References always resolve against the bucket the referencing service uses — that service’s own bucket: override when one is set, otherwise the app’s top-level bucket:. There is no way to name an arbitrary third bucket in a reference, unlike a kind: webhook secret. An ordinary injection value may also mix a tag with surrounding text, such as "Bearer ${bucket.secrets.API_KEY}". location: server_variable is stricter than the rest. Its value must be a complete ${bucket.env.KEY} or ${bucket.values.KEY} reference — never a literal, never interpolated, never a secret — because host routing has to stay non-secret and reviewable. Plan checks name against the service and operation server templates and rejects an undeclared one.

Which value wins

Source	Precedence
Workspace `execution_policy.server_variables`	Final authority
Injection with `mode: force`	Overrides connection-resource input
Connection-resource input	Overrides a `default` injection
Injection with `mode: default`	Supplies the app value ahead of a provider fallback
Provider-declared fallback	Last resort

An omitted mode canonicalizes to force.

A host template must keep a fixed registrable anchor such as .sendbird.com. Whole-host or public-suffix-only forms like https://{host} or https://{tenant}.com fail closed — Fused validates the resolved value and the final HTTPS URL before dispatch.

Inspect a bucket

fused-cli bucket secret list prod-credentials
fused-cli bucket value list prod-credentials
fused-cli bucket sdks prod-credentials

Permissions

Action	Needs
List or show a bucket	`bucket.read`
Read values	`bucket.values.read`
List secret metadata	`credentials.metadata.read`
Create a bucket, change values	`bucket.manage`
Change secrets	`credentials.manage`

Connect a user's account

Static credentials cover one identity. OAuth covers one per end user.

Get Started

Guides

Advanced

Reference

Store credentials

Use managed auth or your own credentials

One app, different buckets per service

Pick a bucket before you write to one

Set up or edit provider credentials

Supply values for automation

`connect` flags

Store named secrets, environment values, and certificates

Inspect or retrieve secrets

Store a non-secret value

Inject a bucket value into a request

Which value wins

Inspect a bucket

Permissions

Connect a user's account

​Use managed auth or your own credentials

​One app, different buckets per service

​Pick a bucket before you write to one

​Set up or edit provider credentials

​Supply values for automation

​connect flags

​Store named secrets, environment values, and certificates

​Inspect or retrieve secrets

​Store a non-secret value

​Inject a bucket value into a request

​Which value wins

​Inspect a bucket

​Permissions

Connect a user's account

Use managed auth or your own credentials

One app, different buckets per service

Pick a bucket before you write to one

Set up or edit provider credentials

Supply values for automation

`connect` flags

Store named secrets, environment values, and certificates

Inspect or retrieve secrets

Store a non-secret value

Inject a bucket value into a request

Which value wins

Inspect a bucket

Permissions