<!-- Extension API v0 — pre-1.0. Interfaces may change without notice until P2 seals the custom-code format. First-party extensions track HEAD. -->

# `secret.set`

Store or rotate a write-only credential (PSP keys). Values are never readable back.

- **scope**: `secrets:write`
- **storefront-visible** (bumps the catalog generation): no
- **destructive**: no

## Payload

| field | type | required | notes |
|---|---|---|---|
| `key` | string (/^[a-z0-9_]+(\.[a-z0-9_]+)*$/, ≤128 chars) | yes |  |
| `value` | string (≤4096 chars) | yes |  |

### JSON Schema

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "key": {
      "type": "string",
      "maxLength": 128,
      "pattern": "^[a-z0-9_]+(\\.[a-z0-9_]+)*$"
    },
    "value": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096
    }
  },
  "required": [
    "key",
    "value"
  ],
  "additionalProperties": false
}
```