# Minimal (header auth)
aivault credential create my-api \
--provider my-api \
--secret-ref vault:secret:<secret-id> \
--auth header \
--host api.example.com
# With custom header template
aivault credential create my-api \
--provider my-api \
--secret-ref vault:secret:<secret-id> \
--auth header \
--header-name x-api-key \
--value-template "{{secret}}" \
--host api.example.com
# Query auth
aivault credential create my-api \
--provider my-api \
--secret-ref vault:secret:<secret-id> \
--auth query \
--query-param api_key \
--host api.example.com
# Per-tenant host override (Shopify)
aivault credential create my-shopify \
--provider shopify \
--secret-ref vault:secret:<secret-id> \
--host my-store.myshopify.com
# Multi-header auth
aivault credential create my-datadog \
--provider my-datadog \
--secret-ref vault:secret:<secret-id> \
--auth multi-header \
--auth-header "DD-API-KEY={{api_key}}" \
--auth-header "DD-APPLICATION-KEY={{app_key}}" \
--host api.datadoghq.com
# OAuth2
aivault credential create my-spotify \
--provider spotify \
--secret-ref vault:secret:<secret-id> \
--auth oauth2 \
--grant-type refresh_token \
--token-endpoint https://accounts.spotify.com/api/token \
--host api.spotify.com
# AWS SigV4
aivault credential create my-bedrock \
--provider aws-bedrock \
--secret-ref vault:secret:<secret-id> \
--auth aws-sigv4 \
--aws-service bedrock-runtime \
--aws-region us-east-1 \
--host bedrock-runtime.us-east-1.amazonaws.com
# Workspace-scoped
aivault credential create my-api-staging \
--provider my-api \
--secret-ref vault:secret:<secret-id> \
--auth header \
--host api-staging.example.com \
--workspace-id staging
# Postgres policy ceiling
aivault credential create app-db \
--provider postgres \
--secret-ref vault:secret:<secret-id> \
--host db.example.com:5432 \
--workspace-id staging \
--max-policy-mode read-only