# Create or update an organization secret

From **GitHub v3 REST API**.

`PUT /orgs/{org}/actions/secrets/{secret_name}`

Creates or updates an organization secret with an encrypted value. Encrypt your secret using
[LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). You must authenticate using an access
token with the `admin:org` scope to use this endpoint. GitHub Apps must have the `secrets` organization permission to
use this endpoint.

#### Example encrypting a secret using Node.js

Encrypt your secret using the [tweetsodium](https://github.com/github/tweetsodium) library.

```
const sodium = require('tweetsodium');

const key = "base64-encoded-public-key";
const value = "plain-text-secret";

// Convert the message and key to Uint8Array's (Buffer implements that interface)
const messageBytes = Buffer.from(value);
const keyBytes = Buffer.from(key, 'base64');

// Encrypt using LibSodium.
const encryptedBytes = sodium.seal(messageBytes, keyBytes);

// Base64 the encrypted secret
const encrypted = Buffer.from(encryptedBytes).toString('base64');

console.log(encrypted);
```


#### Example encrypting a secret using Python

Encrypt your secret using [pynacl](https://pynacl.readthedocs.io/en/latest/public/#nacl-public-sealedbox) with Python 3.

```
from base64 import b64encode
from nacl import encoding, public

def encrypt(public_key: str, secret_value: str) -> str:
  """Encrypt a Unicode string using the public key."""
  public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
  sealed_box = public.SealedBox(public_key)
  encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
  return b64encode(encrypted).decode("utf-8")
```

#### Example encrypting a secret using C#

Encrypt your secret using the [Sodium.Core](https://www.nuget.org/packages/Sodium.Core/) package.

```
var secretValue = System.Text.Encoding.UTF8.GetBytes("mySecret");
var publicKey = Convert.FromBase64String("2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvvcCU=");

var sealedPublicKeyBox = Sodium.SealedPublicKeyBox.Create(secretValue, publicKey);

Console.WriteLine(Convert.ToBase64String(sealedPublicKeyBox));
```

#### Example encrypting a secret using Ruby

Encrypt your secret using the [rbnacl](https://github.com/RubyCrypto/rbnacl) gem.

```ruby
require "rbnacl"
require "base64"

key = Base64.decode64("+ZYvJDZMHUfBkJdyq5Zm9SKqeuBQ4sj+6sfjlH4CgG0=")
public_key = RbNaCl::PublicKey.new(key)

box = RbNaCl::Boxes::Sealed.from_public_key(public_key)
encrypted_secret = box.encrypt("my_secret")

# Print the base64 encoded secret
puts Base64.strict_encode64(encrypted_secret)
```

## Parameters

### `org`

- Location: path
- Required: true
- Type: `string`

### `secret_name`

- Location: path
- Required: true
- Type: `string`

secret_name parameter

## Request body

- Required: true
### `application/json`

- Type: `object`

```json
{
  "encrypted_value": "c2VjcmV0",
  "key_id": "012345678912345678",
  "selected_repository_ids": [
    "1296269",
    "1296280"
  ],
  "visibility": "selected"
}
```

```json
{"properties":{"encrypted_value":{"description":"Value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get an organization public key](https://docs.github.com/enterprise-server@3.0/rest/reference/actions#get-an-organization-public-key) endpoint.","pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$","type":"string"},"key_id":{"description":"ID of the key you used to encrypt the secret.","type":"string"},"selected_repository_ids":{"description":"An array of repository ids that can access the organization secret. You can only provide a list of repository ids when the `visibility` is set to `selected`. You can manage the list of selected repositories using the [List selected repositories for an organization secret](https://docs.github.com/enterprise-server@3.0/rest/reference/actions#list-selected-repositories-for-an-organization-secret), [Set selected repositories for an organization secret](https://docs.github.com/enterprise-server@3.0/rest/reference/actions#set-selected-repositories-for-an-organization-secret), and [Remove selected repository from an organization secret](https://docs.github.com/enterprise-server@3.0/rest/reference/actions#remove-selected-repository-from-an-organization-secret) endpoints.","items":{"type":"string"},"type":"array"},"visibility":{"description":"Configures the access that repositories have to the organization secret. Can be one of:  \n\\- `all` - All repositories in an organization can access the secret.  \n\\- `private` - Private repositories in an organization can access the secret.  \n\\- `selected` - Only specific repositories can access the secret.","enum":["all","private","selected"],"type":"string"}},"required":["visibility"],"type":"object"}
```

## Responses

### `201`

Response when creating a secret

### `application/json`

- Type: `object`

An object without any properties.

```json
{"additionalProperties":false,"description":"An object without any properties.","title":"Empty Object","type":"object"}
```

### `204`

Response when updating a secret

## Request examples

### cURL

```shell
curl --request PUT \
  --url {protocol}://{hostname}/api/v3/orgs/{org}/actions/secrets/{secret_name} \
  --header 'content-type: application/json' \
  --data '{
  "encrypted_value": "c2VjcmV0",
  "key_id": "012345678912345678",
  "selected_repository_ids": [
    "1296269",
    "1296280"
  ],
  "visibility": "selected"
}'
```