> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-gateway/5/iagctl/create-secret-provider/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# iagctl create secret-provider

Gateway 5.5+

Create a named secret provider configuration in Itential Gateway.

A secret provider stores the connection and authentication settings for an external secrets manager. Once created, you can reference a provider when creating secret aliases using `iagctl create secret --provider <name>`.

For more information, see [External secrets overview](../secrets/external-secrets/overview).

## Syntax

```bash
iagctl create secret-provider <name> --type <provider-type> [flags]
```

## Provider types

| Type       | Description                                                                                                             |
| ---------- | ----------------------------------------------------------------------------------------------------------------------- |
| `vault`    | HashiCorp Vault KV Secrets Engine v2. Supports token authentication and AppRole authentication.                         |
| `cyberark` | CyberArk Central Credential Provider (CCP) with mutual TLS client certificate authentication.                           |
| `plugin`   | Custom subprocess-based provider. Use this type to connect to any secrets manager not covered by the bundled providers. |

## Examples

### Create a Vault provider with AppRole authentication

```bash
iagctl create secret-provider prod-vault \
  --type vault \
  --url https://vault.example.com:8200 \
  --auth-method approle \
  --role-id <role-id-uuid> \
  --secret-id-file /etc/gateway/secret_id \
  --secrets-endpoint itential/data
```

### Create a Vault provider with token authentication

```bash
iagctl create secret-provider dev-vault \
  --type vault \
  --url https://vault.dev.example.com:8200 \
  --auth-method token \
  --token /etc/gateway/vault_token \
  --secrets-endpoint itential/data
```

### Create a CyberArk CCP provider

```bash
iagctl create secret-provider cyberark-prod \
  --type cyberark \
  --url https://cyberark.company.com/AIMWebService \
  --app-id Itential-Gateway \
  --cert-file /etc/pki/cyberark/cert.pem \
  --key-file /etc/pki/cyberark/key.pem \
  --ca /etc/pki/cyberark/ca.pem
```

### Create a plugin provider

```bash
iagctl create secret-provider my-plugin \
  --type plugin \
  --command /opt/itential/plugins/secrets-plugin \
  --env VAULT_ADDR=https://vault.example.com:8200 \
  --env VAULT_SECRETS_ENDPOINT=itential/data \
  --env VAULT_TOKEN_FILE=/etc/gateway/vault_token
```

## Options

```bash
  --type string   The provider type: vault, cyberark, or plugin (required)
  -h, --help      Help for secret-provider
```

### Vault options

Never pass credentials as command-line values. Store tokens and key files on disk and reference them by file path.

```bash
  --url string              Vault server URL
  --auth-method string      Authentication method: token or approle
  --token string            Path to the Vault token file (token auth)
  --role-id string          AppRole role ID value (approle auth)
  --secret-id string        AppRole secret ID inline value (approle auth)
  --secret-id-file string   Path to the AppRole secret ID file (approle auth, preferred)
  --secrets-endpoint string Mount path for the Vault KV v2 secrets engine (e.g. itential/data). This path is prepended automatically to the --secret value when creating a secret alias against this provider.
```

### CyberArk options

```bash
  --url string                CyberArk CCP server URL, including the AIMWebService base path
  --app-id string             CyberArk application ID for this Gateway instance
  --cert-file string          Path to the client certificate file
  --key-file string           Path to the private key file
  --ca string                 Path to the CA certificate file
  --allow-invalid-certs       Skip TLS certificate verification (development environments only)
```

### Plugin options

```bash
  --command string      Path to the plugin executable on the gateway server
  --env stringArray     Non-sensitive configuration passed to the plugin at invocation time, in KEY=VALUE format; repeatable
```

## Options inherited from parent commands

```bash
  --profile string   Specify the client profile to use (case-insensitive, defaults to [client] section)
  --config string    Path to the configuration file
  --raw              Display the result of the command in raw format
  --verbose          Enable verbose output
```