> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goldsky.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Database secrets

> Create and manage database credentials for Mirror sinks using the goldsky secret CLI.

## Overview

In order for Goldsky to connect to your sink, you have to configure secrets. Secrets refer to your datastore credentials which are securely stored in your Goldsky account.

You can create and manage your secrets with the `goldsky secret` command. To see a list of available commands and how to use them, please refer to the output of `goldsky secret -h`.

For sink-specific secret information, please refer to the [individual sink pages](/mirror/sinks).

## Guided CLI experience

If you create a pipeline with `goldsky pipeline create <pipeline-name>`, there is no need to create a secret beforehand. The CLI will list existing secrets and offer you the option of creating a new secret as part of the pipeline creation flow.

## Secret types

Running `goldsky secret create` with no `--value` starts an interactive prompt that first asks you to pick a secret type, then collects the fields that type requires (host, credentials, region, etc.) and prints the permissions the credentials need before you paste them in. Every stored secret is tagged with one of these types:

| Type            | Used for                                                                                |
| --------------- | --------------------------------------------------------------------------------------- |
| `jdbc`          | Postgres and MySQL sinks. Enter a connection string or type in host/port/user/pass etc. |
| `clickHouse`    | ClickHouse sinks. URL, username, password, database name                                |
| `elasticSearch` | Elasticsearch sinks. Host URL, username, password                                       |
| `opensearch`    | OpenSearch sinks. Host URL, username, password                                          |
| `kafka`         | Kafka sinks, with `PLAINTEXT`, `SASL_PLAINTEXT`, or `SASL_SSL` protocols                |
| `s3`            | S3 and S3-compatible object storage sinks. Access key, secret key, region               |
| `sqs`           | AWS SQS sinks. Access key, secret key, region                                           |
| `pubsub`        | Google Cloud Pub/Sub sinks. GCP project ID plus a service-account JSON key              |
| `dynamodb`      | AWS DynamoDB sinks. Access key, secret key, region                                      |
| `httpauth`      | Webhook sinks — stores a single auth header as a `secretKey` / `secretValue` pair       |

Compose secrets are created through the [`goldsky compose` CLI](/compose/cli-reference#secrets).

<Note>
  Turbo webhook sinks accept an `httpauth` secret via `secret_name`, but the header it injects cannot also appear in the sink's inline `headers:` field — pick one or the other. See the [Turbo webhook sink](/turbo-pipelines/sinks/webhook#secret-creation) for details.
</Note>

For the JSON payload each type expects when you pass `--value` instead of using the interactive prompt, see the individual [sink pages](/mirror/sinks).

## The `--value` flag expects JSON

`goldsky secret create --value` treats its payload as JSON so a single secret can hold the structured credentials most sinks require (host, port, username, password, etc.). Every sink example on this site passes a JSON object to `--value` for that reason — for example:

```bash theme={null}
goldsky secret create --name A_POSTGRES_SECRET --value '{
  "type": "postgres",
  "host": "db.example.com",
  "port": 5432,
  "user": "goldsky",
  "password": "…",
  "databaseName": "analytics"
}'
```

See each [sink page](/mirror/sinks/supported-sinks) for the exact schema its secret expects. Wrap the argument in single quotes so the shell does not strip the inner double quotes.

If your secret is a single plain value (an API token, a URL, a connection string) and you would rather not hand-craft JSON, run `goldsky secret create` with no flags — the interactive prompts accept a plain string and the CLI encodes it correctly.


## Related topics

- [Create a cross-chain subgraph](/subgraphs/guides/create-a-cross-chain-subgraph.md)
- [ClickHouse](/turbo-pipelines/sinks/clickhouse.md)
- [MySQL](/turbo-pipelines/sinks/mysql.md)
- [PostgreSQL](/turbo-pipelines/sinks/postgres.md)
- [CLI Reference](/reference/cli.md)