# generate_secret

`tools/call` · `POST /clanker/v1/secrets:generate`

Generate a new value on the server for a secret in each product and environment given, such as to rotate a token, creating the name where it is missing. The value is never returned; a key pair returns only its public key. Returns each pair's outcome and version. Needs write access; production needs an admin or owner.

- Area: Vault
- Needs the write grant. Idempotent.

## Inputs

- `products` (array of strings, required): The products' slugs, such as storefront.
- `environments` (array of strings, required): The environments' slugs, such as staging. Each product must be deployed to each.
- `name` (string, required): The secret's name, such as DATABASE_URL.
- `generator` (object, required): What to generate. Options left out use their defaults.
  - `type` (string, one of: `token`, `password`, `uuid`, `ed25519`, required): What to generate: a random token, a password, a UUID or an Ed25519 key pair.
  - `bytes` (integer): For a token, the random bytes, from 16 to 512. Defaults to 32. From -9,007,199,254,740,991 to 9,007,199,254,740,991.
  - `encoding` (string, one of: `hex`, `base64`, `base64url`): For a token, how to write the bytes. Defaults to hex.
  - `length` (integer): For a password, its length, from 8 to 256 characters. Defaults to 32. From -9,007,199,254,740,991 to 9,007,199,254,740,991.
  - `lowercase` (boolean): For a password, whether to use lowercase letters. Defaults to true.
  - `uppercase` (boolean): For a password, whether to use capital letters. Defaults to true.
  - `digits` (boolean): For a password, whether to use digits. Defaults to true.
  - `symbols` (boolean): For a password, whether to use the symbols -_.~+=. Defaults to true.

## Request

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "generate_secret",
    "arguments": {
      "products": [
        "storefront"
      ],
      "environments": [
        "staging",
        "production"
      ],
      "name": "SESSION_SECRET",
      "generator": {
        "type": "token",
        "bytes": 32
      }
    }
  }
}
```

## HTTP request

The same call over the clanker HTTP API, with a clanker OAuth access token:

```bash
curl -X POST https://api.clankership.com/clanker/v1/secrets:generate \
  -H "Authorization: Bearer $CLANKER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "products": [
      "storefront"
    ],
    "environments": [
      "staging",
      "production"
    ],
    "name": "SESSION_SECRET",
    "generator": {
      "type": "token",
      "bytes": 32
    }
  }'
```