diff --git a/src/git.ts b/src/git.ts
index 6fb46e654..79c4782af 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -270,7 +270,7 @@ export class Git {
     secretJsonPaths.forEach((objectPath) => {
       const val = get(config, objectPath)
       if (val) {
-        set(secretData, objectPath, val)
+        set(secretData, fileMap.v2 ? objectPath.replace('.spec', '') : objectPath, val)
         unset(plainData, objectPath)
       }
     })
diff --git a/src/otomi-stack.ts b/src/otomi-stack.ts
index 6ddc98243..9d38b8825 100644
--- a/src/otomi-stack.ts
+++ b/src/otomi-stack.ts
@@ -343,7 +343,13 @@ export default class OtomiStack {
         cleanSecretPaths.push(p)
       } else {
         teams.forEach((teamId: string) => {
-          if (p.indexOf(teamProp) === 0) cleanSecretPaths.push(p.replace(teamProp, `teamConfig.${teamId}`))
+          if (p.indexOf(teamProp) === 0)
+            cleanSecretPaths.push(
+              p
+                .replace(teamProp, `teamConfig.${teamId}`)
+                // add spec to the path for v2 endpoints
+                .replace(`teamConfig.${teamId}.settings`, `teamConfig.${teamId}.settings.spec`),
+            )
         })
       }
     })
@@ -680,6 +686,19 @@ export default class OtomiStack {
   async createAplTeam(data: AplTeamSettingsRequest, deploy = true): Promise<AplTeamSettingsResponse> {
     const teamName = data.metadata.name
 
+    if (isEmpty(data.spec.password)) {
+      debug(`creating password for team '${teamName}'`)
+      // eslint-disable-next-line no-param-reassign
+      data.spec.password = generatePassword({
+        length: 16,
+        numbers: true,
+        symbols: false,
+        lowercase: true,
+        uppercase: true,
+        strict: true,
+      })
+    }
+
     const teamConfig = this.repoService.createTeamConfig(data)
     const team = teamConfig.settings
     const apps = getAppList()