---
title: Add secrets
description: Add secrets using the influx CLI or the InfluxDB API.
url: https://docs.influxdata.com/influxdb/v2/admin/secrets/add/
estimated_tokens: 973
product: InfluxDB OSS v2
version: v2
---

# Add secrets

This page documents an earlier version of InfluxDB OSS. [InfluxDB 3 Core](/influxdb3/core/) is the latest stable version.

#### API token hashing is enabled by default in InfluxDB OSS 2.9.0

Stronger token security: tokens are stored as hashes on disk, so a copy of the database file doesn’t expose usable tokens. Existing tokens are hashed on first startup and the original strings can’t be recovered afterward — **capture any plaintext tokens you still need before you upgrade**.

For more information, see [Token hashing](/influxdb/v2/admin/tokens/#token-hashing).

Add secrets using the `influx` command line interface (CLI) or the InfluxDB API.

-   [Add a secret using the influx CLI](#add-a-secret-using-the-influx-cli)
-   [Add a secret using the InfluxDB API](#add-a-secret-using-the-influxdb-api)

## Add a secret using the influx CLI

Use the [`influx secret update` command](/influxdb/v2/reference/cli/influx/secret/update/) to add a new secret to your organization. Provide the secret key with the `-k` or `--key` flag. You may also provide the secret value with the `-v` or `--value` flag. If you do not provide the secret value with the `-v` or `--value` flag, enter the value when prompted.

Providing a secret value with the `-v` or `--value` flag may expose the secret in your command history.

```sh
# Syntax
influx secret update -k <secret-key>

# Example
influx secret update -k foo
```

## Add a secret using the InfluxDB API

Use the `PATCH` request method and the `/orgs/{orgID}/secrets` API endpoint to add a new secret to your organization.

**Include the following:**

-   Your [organization ID](/influxdb/v2/admin/organizations/view-orgs/#view-your-organization-id) in the request URL
-   Your [API token](/influxdb/v2/admin/tokens/view-tokens/) in the `Authorization` header
-   The secret key-value pair in the request body

```sh
curl --request PATCH http://localhost:8086/api/v2/orgs/<org-id>/secrets \
  --header 'Authorization: Token YOURAUTHTOKEN' \
  --header 'Content-type: application/json' \
  --data '{
	"<secret-key>": "<secret-value>"
}'
```

[secrets](/influxdb/v2/tags/secrets/) [security](/influxdb/v2/tags/security/)