oz0 tenant credential bind

Bind a secret or a connection's token to a host (--host and --header, --basic-user or --query), or a secret to an argument (--function and --argument)

For: Operators and developers looking up a command.

Bind a secret or a connection's token to a host (--host and --header, --basic-user or --query), or a secret to an argument (--function and --argument)

Usage

oz0 tenant credential bind <tenant> <SECRET> | bind <tenant> --connection <NAME> [flags]

Flags

FlagTypeDefaultDescription
--argumentstringan argument binding: the argument's JSON pointer, such as /env/API_KEY
--basic-userstringBasic authentication as this user, with the secret as the password
--connectionstringbind this connection's per-call token instead of a secret: sealed to the node for each call
--formatstring{secret}the header's value, with {secret} where the value goes
--functionstringan argument binding: the <tool>.<function> whose argument takes {{secret:NAME}}
--headerstringthe header the secret goes in, such as Authorization
--hoststringthe host the secret goes to: a name, or *.domain for one label more; never an address
--jsonboolprint JSON instead of a table
--methodstringArraya method the secret goes on (repeatable; default: every method)
--path-prefixstringthe only path, and the paths below it, the secret goes on (a * matches within one segment)
--portint32443the host's port
--querystringa query parameter the secret goes in (only where the API wants one: logs keep URLs)
--shapestringwhat the placeholder looks like, such as ghp_{36}, for a tool that checks a token's format

Inherited flags

FlagTypeDefaultDescription
--contextstring$OZ0_CONTEXT or <config dir>/orchestrator-zero/context.jsonCLI context file written by server init
--log-levelstringinfolog level: debug, info, warn or error

See all oz0 commands and the global flags.

On this page
Copyright © 2026