Set and manage workspace or personal secrets.
Personal secrets belong to the caller across workspaces. Workspace secrets are shared resources. Listings include stored values only for workspace secrets marked visible (unredacted); all other entries contain metadata.
sim secrets is also spelled sim secret.
These commands accept the global options.
List secrets
OAuth login or personal API key required.
sim secrets list [options]Options
API request and response schemas: listSecrets.
Create or replace a named secret, such as an API key or environment variable
OAuth login or personal API key required.
sim secrets set <name> [options]Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret name, as referenced in workflows |
Options
| Option | Required | Description |
|---|---|---|
--scope <scope> | Yes | Secret ownership scope. Accepted values: workspace, personal. |
--value <value|@file> | No | Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one. |
--description <description> | No | What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged. |
--unredacted | No | Opt the workspace secret out of redaction: its value then appears in plaintext in run logs, model-visible content, and files, including publicly shared log links. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave the current setting untouched. Pass --no-unredacted to restore redaction. |
--no-unredacted | No | Send --unredacted as false. |
Omit --value to enter it privately in a terminal. For an existing workspace secret, passing only --description or a redaction flag keeps the stored value and does not prompt. Personal secrets always require a value; they accept no writable metadata. In scripts, pass --value @path or --value @-.
API request and response schemas: setSecret.
Delete secret
OAuth login or personal API key required.
This deletes the secret; anything using it may stop working.
sim secrets delete <name> [options]Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret to delete. |
Options
API request and response schemas: deleteSecret.