---
title: "oz0 tenant credential bind"
description: "Bind a secret or a connection's token to a host (--host and --header, --basic-user or --query), or a secret to an argument (--function and --argument)"
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/credential/bind"
---
# oz0 tenant credential bind

> Bind a secret or a connection's token to a host (--host and --header, --basic-user or --query), or a secret to an argument (--function and --argument)

For: Operators and developers looking up a command.

Bind a secret or a connection's token to a host (--host and --header, --basic-user or --query), or a secret to an argument (--function and --argument)

## Usage

```bash
oz0 tenant credential bind <tenant> <SECRET> | bind <tenant> --connection <NAME> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --argument
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      an argument binding: the argument's JSON pointer, such as /env/API_KEY
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --basic-user
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      Basic authentication as this user, with the secret as the password
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --connection
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      bind this connection's per-call token instead of a secret: sealed to the node for each call
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --format
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        {secret}
      </code>
    </td>
    
    <td>
      the header's value, with {secret} where the value goes
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --function
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      an argument binding: the &lt;tool>.&lt;function> whose argument takes {{secret:NAME}}
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --header
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the header the secret goes in, such as Authorization
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --host
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the host the secret goes to: a name, or *.domain for one label more; never an address
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --method
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a method the secret goes on (repeatable; default: every method)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --path-prefix
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the only path, and the paths below it, the secret goes on (a * matches within one segment)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --port
      </code>
    </td>
    
    <td>
      int32
    </td>
    
    <td>
      <code>
        443
      </code>
    </td>
    
    <td>
      the host's port
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --query
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a query parameter the secret goes in (only where the API wants one: logs keep URLs)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --shape
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      what the placeholder looks like, such as ghp_{36}, for a tool that checks a token's format
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.