---
title: "Grants"
description: "Let an EZGH product read a secret for one of its resources, see who can, and revoke access."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grants

A grant lets an EZGH product read one of your secrets when it needs to, for one of its own
resources, without anyone handing the product the value. The product keeps a reference to the
secret and asks for the value each time. The first product to use grants will be MCP Central.

## What a grant says

| Field | Meaning |
| --- | --- |
| `consumer` | The product's namespace, such as `mcp`. |
| `consumerResource` | The resource name of the product's resource that may read the secret. It must be in the secret's organization, in any project, and of a type that product uses secrets for. |
| `version` | `latest` or a version number. A grant for `latest` reads only `latest`; a grant for a number reads only that version. |

- A second grant for the same product and resource is `409 grant_exists`.
- A secret can have up to 100 grants.
- EZGH can't check that the product's resource exists. A grant for a resource that doesn't exist
  has no effect, and you can see and revoke it.
- Destroying the version a grant is pinned to, or deleting the secret, stops the grant working.

## Create and revoke grants

You create grants, usually in the product's own console page when you choose a secret for a
resource. Creating one needs `secrets.grants.create` and `secrets.versions.access` on the secret
(see [Permissions](/secrets#permissions)); see [CreateSecretGrant](/secrets-api/CreateSecretGrant/).
A secret's `grantCount` and [ListSecretGrants](/secrets-api/ListSecretGrants/) show who has
access, and [DeleteSecretGrant](/secrets-api/DeleteSecretGrant/) revokes a grant, which
takes effect on the product's next read.

```sh
ezgh secrets grants list prod/app
ezgh secrets grants revoke prod/app sgr_k3f9a0x2m7qp
```

The CLI lists and revokes grants; it doesn't create them.

## Billing

A product's reads through a grant aren't billed to you. The secret's fields are still billed as
usual under [Pricing](/secrets/pricing-and-limits).

## Trails

Every time a product reads a secret through a grant, Trails records a `ResolveSecret` event with
the event source `secrets.ezghcloud.com`. Its `userIdentity` is an `EzghService`, with `invokedBy`
set to the product (such as `mcp.ezghcloud.com`), and it names the secret, version, field,
grant and the product's resource. Values are never recorded.

A product can read a secret only through a grant that matches the secret, product, resource and
version. Any other request is refused with the same `404` it gives for a secret that doesn't
exist, so a product learns nothing about secrets it has no grant for.

Source: https://docs.ezghcloud.com/secrets/grants/index.mdx