sim secrets is also spelled sim secret.
Every command below also accepts the global options.
Delete secret
sim secrets delete <name> [options]Delete Secret (OAuth login or personal API key required)
Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret to delete. |
Options
| Option | Required | Description |
|---|---|---|
--scope <value> | Yes | Whether the secret belongs to the workspace or to the caller. A personal secret belongs to the caller across every workspace, not to one workspace. Accepted values: workspace, personal. |
-y, --yes | Yes | Confirm this operation. |
List secrets
sim secrets list [options]List Secrets (OAuth login or personal API key required)
Options
| Option | Required | Description |
|---|---|---|
--scope <value> | No | Restrict results to one ownership scope. Accepted values: workspace, personal. |
--search <value> | No | Case-insensitive substring match against the secret name. |
--sort-by <value> | No | Field used to sort the result. Sorting by name is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order. Accepted values: name, createdAt, updatedAt. |
--sort-order <value> | No | Sort direction. Accepted values: asc, desc. |
--limit <n> | No | Maximum items to return (0 for everything). Defaults to 0. |
Create or replace a named secret
sim secrets set <name> [options]Create or replace a named secret (OAuth login or personal API key required)
Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret name, as referenced in workflows |
Options
| Option | Required | Description |
|---|---|---|
--scope <scope> | Yes | Secret ownership scope. Accepted values: workspace, personal. |
--value <value|@file> | No | Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one. |
--description <description> | No | What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged. |
--unredacted | No | Opt the workspace secret out of redaction: its value then appears in plaintext in run logs, model-visible content, and files, including publicly shared log links. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave the current setting untouched. Pass --no-unredacted to restore redaction. |
--no-unredacted | No | Send --unredacted as false. |