oz secret — store and retrieve agent secrets

Create, update, delete, and list secrets in Warp’s managed secret store. Secrets are injected automatically into cloud agent runs.

Warp’s managed secret store lets you upload sensitive credentials — such as API keys, database passwords, or cloud provider access keys — and have them injected automatically into your cloud agent containers at runtime. The oz secret command group provides full CRUD operations on secrets. Secrets can be scoped to a personal account or a team.

Synopsis

oz secret <subcommand> [flags]

Subcommands

Subcommand	Description
create [name]	Create a new secret
update <name>	Update an existing secret’s value or description
delete <name>	Delete a secret
list	List all secrets

---

oz secret create

Creates a new secret. You can create a generic raw-value secret, or use a provider-specific subcommand (such as anthropic api-key) to create a typed secret with the correct structure.

oz secret create [name] [flags]
oz secret create anthropic api-key <name> [flags]
oz secret create anthropic bedrock-api-key <name> [flags]
oz secret create anthropic bedrock-access-key <name> [flags]

If you do not pass a value via --value-file, the CLI reads the secret value from standard input.

Flags (generic create)

name · string

Name of the secret to create (positional argument).

--type · string · default: "raw-value"

Secret type. Accepted values: raw-value, anthropic-api-key.

Short form: -t

--value-file · string

Path to a file whose contents become the secret value. If not provided, the value is read from standard input.

Short form: -f

--description · string

Optional description for the secret.

Short form: -d

--team · boolean

Create the secret at the team level, making it available to teammates. Mutually exclusive with --personal.

--personal · boolean

Create the secret as private to your account (default). Mutually exclusive with --team.

Provider-specific subcommands

oz secret create anthropic api-key

Creates a secret that holds a direct Anthropic API key, with the correct type metadata for use by Claude harness agent runs.

oz secret create anthropic api-key <name> [flags]

name · string

Name of the secret (positional argument).

--value-file · string

Path to a file containing the API key.

Short form: -f

--description · string

Optional description.

Short form: -d

oz secret create anthropic bedrock-api-key

Creates a secret for an Anthropic API key accessed via Amazon Bedrock.

oz secret create anthropic bedrock-api-key <name> [flags]

--bedrock-api-key · string

Bedrock API key. If not provided, the CLI prompts interactively.

--region · string

AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.

oz secret create anthropic bedrock-access-key

Creates a secret for Anthropic Bedrock authentication using AWS access keys.

oz secret create anthropic bedrock-access-key <name> [flags]

--access-key-id · string

AWS access key ID. If not provided, the CLI prompts interactively.

--secret-access-key · string

AWS secret access key. If not provided, the CLI prompts interactively.

--session-token · string

AWS session token. If not provided, the CLI prompts interactively.

--region · string

AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.

Examples

# Create a secret by piping a value from stdin
echo "my-secret-value" | oz secret create my-database-password

# Create a secret by reading from a file
oz secret create my-api-key --value-file ./api-key.txt

# Create a secret with a description
oz secret create stripe-webhook-secret \
  --description "Stripe webhook signing secret for production" \
  --value-file ./stripe-secret.txt

# Create an Anthropic API key secret
oz secret create anthropic api-key my-claude-key --value-file ./claude-key.txt

# Create an Anthropic Bedrock access key secret interactively
oz secret create anthropic bedrock-access-key my-bedrock-creds

---

oz secret update

Updates an existing secret. You can update the value, the description, or both. Renaming or moving secrets is not supported.

oz secret update <name> [flags]

Arguments

Argument	Description
name	Name of the secret to update

Flags

--value · boolean

Prompt for a new value for the secret interactively.

--value-file · string

Path to a file whose contents become the new secret value.

Short form: -f

--description · string

New description for the secret. If omitted, the description is not changed.

Short form: -d

Examples

# Update a secret's value from a file
oz secret update my-api-key --value-file ./new-key.txt

# Update only the description
oz secret update my-api-key --description "Rotated 2024-06-01"

# Prompt interactively for a new value
oz secret update my-api-key --value

---

oz secret delete

Deletes a secret from the managed store.

oz secret delete <name> [flags]

Arguments

Argument	Description
name	Name of the secret to delete

Flags

--force · boolean

Delete without asking for confirmation.

Examples

oz secret delete old-api-key
oz secret delete old-api-key --force

---

oz secret list

Lists all secrets in the managed store. Secret values are never shown — only names and metadata.

oz secret list

Examples

oz secret list
oz secret list --output-format json