privy credentials create

Generate an app API secret with an explicit env, Keychain, both or none storage choice.

Usage

privy credentials create [options]

Options

Option	Description
--dry-run	Validate and print the API request without network access or credentials.
--yes	Confirm this mutation or export.
--secret-store <destination>	App API secret destination: env, keychain, both or none; required non-interactively.
--env-output <path>	Server env file for env/both; preserve other variables; write with mode 0600.
--env-key <name>	Server-only env variable (default PRIVY_APP_SECRET).
--overwrite-env	Explicitly allow replacing the target variable in an existing env file.
--body <json>	JSON body, or - to read stdin.
--file <path>	JSON body file, or - to read stdin.
--access-mode <string>	Explicit privilege choice. Cannot be changed later. Privy validates availability.
--allow-production	Explicitly allow this production mutation; also requires --yes.

Global options such as --app, --account and --profile also apply. See the command reference overview.

Examples

privy credentials create --access-mode read_only --secret-store keychain --dry-run
privy credentials create --access-mode read_only --secret-store keychain --yes

Behavior

• Changes data: yes. Preview with --dry-run, then run with --yes and any required confirmations.
• Scope: app
• Before it runs: Check environment and current same-app key metadata; explicit access mode for creation.
• Production apps: Requires --allow-production and --yes.
• Verification: One-time secret handled according to the explicit storage choice before fresh metadata comparison; deletion verified by absence.
• Retries: None.
• Caution: Deletion breaks consumers. Creation never automatically deletes old keys. Store failures after creation require inspecting the reported reference, not recreating blindly.

Related guides

• Credentials and secrets
• Failure recovery

Inspect the full contract locally with privy schema credentials create.