Skip to content
Try for free
On this page

Commands

Secrets

Set and manage workspace or personal secrets.

Personal secrets belong to the caller across workspaces. Workspace secrets are shared resources. Listings include stored values only for workspace secrets marked visible (unredacted); all other entries contain metadata.

sim secrets is also spelled sim secret.

These commands accept the global options.

List secrets

OAuth login or personal API key required.

Code
sim secrets list [options]

Options

OptionRequiredDescription
--scope <value>NoRestrict results to one ownership scope. Accepted values: workspace, personal.
--search <value>NoCase-insensitive substring match against the secret name.
--sort-by <value>NoField used to sort the result. Do not rely on case-insensitive ordering when sorting by name. Defaults to "name". Accepted values: name, createdAt, updatedAt.
--sort-order <value>NoSort direction. Defaults to "asc". Accepted values: asc, desc.
--limit <n>NoMaximum items to return (0 for everything). Defaults to 0.

API request and response schemas: listSecrets.

Create or replace a named secret, such as an API key or environment variable

OAuth login or personal API key required.

Code
sim secrets set <name> [options]

Arguments

ArgumentRequiredDescription
nameYesSecret name, as referenced in workflows

Options

OptionRequiredDescription
--scope <scope>YesSecret ownership scope. Accepted values: workspace, personal.
--value <value|@file>NoSecret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one.
--description <description>NoWhat the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged.
--unredactedNoOpt the workspace secret out of redaction: its value then appears in plaintext in run logs, model-visible content, and files, including publicly shared log links. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave the current setting untouched. Pass --no-unredacted to restore redaction.
--no-unredactedNoSend --unredacted as false.

Omit --value to enter it privately in a terminal. For an existing workspace secret, passing only --description or a redaction flag keeps the stored value and does not prompt. Personal secrets always require a value; they accept no writable metadata. In scripts, pass --value @path or --value @-.

API request and response schemas: setSecret.

Delete secret

OAuth login or personal API key required.

This deletes the secret; anything using it may stop working.

Code
sim secrets delete <name> [options]

Arguments

ArgumentRequiredDescription
nameYesSecret to delete.

Options

OptionRequiredDescription
--scope <value>YesWhether the secret belongs to the workspace or to the caller. A personal secret belongs to the caller across every workspace, not to one workspace. Accepted values: workspace, personal.
-y, --yesYesConfirm this operation.

API request and response schemas: deleteSecret.

Related docs

Was this helpful?
Suggest an edit