Provider credentials

Provider credentials let one provider load the authentication material it needs from another SecretSpec provider. They are supported in SecretSpec 0.15 and later.

The table below is the exhaustive reference for accepted semantic credential names. An explicitly configured provider credential takes precedence over its environment fallback. When more than one fallback is listed, SecretSpec checks them from left to right.

Provider	Credential	Environment fallback	Available since
age	identity	AGE_IDENTITY	0.17+
akv	tenant_id	AZURE_TENANT_ID	0.15+
akv	client_id	AZURE_CLIENT_ID	0.15+
akv	client_secret	AZURE_CLIENT_SECRET	0.15+
bws	access_token	BWS_ACCESS_TOKEN	0.15+
dashlane	service_device_keys	DASHLANE_SERVICE_DEVICE_KEYS	0.18+
infisical	client_id	INFISICAL_CLIENT_ID	0.16+
infisical	client_secret	INFISICAL_CLIENT_SECRET	0.16+
infisical	token	INFISICAL_TOKEN	0.16+
kdbx	password	SECRETSPEC_KDBX_PASSWORD	0.17+
keeper	config	KSM_CONFIG	0.18+
keeper	token	KSM_TOKEN	0.18+
onepassword	service_account_token	OP_SERVICE_ACCOUNT_TOKEN	0.15+
openbao	role_id	BAO_ROLE_ID → VAULT_ROLE_ID	0.17+
openbao	secret_id	BAO_SECRET_ID → VAULT_SECRET_ID	0.17+
openbao	token	BAO_TOKEN → VAULT_TOKEN	0.17+
scaleway	secret_key	SCW_SECRET_KEY	0.17+
sops	age_key	SOPS_AGE_KEY	0.17+
sops	aws_secret_access_key	AWS_SECRET_ACCESS_KEY	0.17+
sops	azure_client_secret	AZURE_CLIENT_SECRET	0.17+
sops	hc_vault_token	VAULT_TOKEN	0.17+
sops	huawei_sdk_ak	HUAWEICLOUD_SDK_AK	0.17+
sops	huawei_sdk_sk	HUAWEICLOUD_SDK_SK	0.17+
sops	google_oauth_access_token	GOOGLE_OAUTH_ACCESS_TOKEN	0.17+
vault	role_id	VAULT_ROLE_ID	0.15+
vault	secret_id	VAULT_SECRET_ID	0.15+
vault	token	VAULT_TOKEN	0.15+

See Provider credentials for credential source addresses, storage commands, one-hop chaining, and runtime handling rules.