> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/warpdotdev/warp/llms.txt
> Use this file to discover all available pages before exploring further.

# oz secret — store and retrieve agent secrets

> Create, update, delete, and list secrets in Warp's managed secret store. Secrets are injected automatically into cloud agent runs.

Warp's managed secret store lets you upload sensitive credentials — such as API keys, database passwords, or cloud provider access keys — and have them injected automatically into your cloud agent containers at runtime. The `oz secret` command group provides full CRUD operations on secrets. Secrets can be scoped to a personal account or a team.

## Synopsis

```bash theme={null}
oz secret <subcommand> [flags]
```

## Subcommands

| Subcommand      | Description                                      |
| --------------- | ------------------------------------------------ |
| `create [name]` | Create a new secret                              |
| `update <name>` | Update an existing secret's value or description |
| `delete <name>` | Delete a secret                                  |
| `list`          | List all secrets                                 |

***

## oz secret create

Creates a new secret. You can create a generic raw-value secret, or use a provider-specific subcommand (such as `anthropic api-key`) to create a typed secret with the correct structure.

```bash theme={null}
oz secret create [name] [flags]
oz secret create anthropic api-key <name> [flags]
oz secret create anthropic bedrock-api-key <name> [flags]
oz secret create anthropic bedrock-access-key <name> [flags]
```

If you do not pass a value via `--value-file`, the CLI reads the secret value from standard input.

### Flags (generic create)

<ParamField path="name" type="string">
  Name of the secret to create (positional argument).
</ParamField>

<ParamField path="--type" type="string" default="raw-value">
  Secret type. Accepted values: `raw-value`, `anthropic-api-key`.

  Short form: `-t`
</ParamField>

<ParamField path="--value-file" type="string">
  Path to a file whose contents become the secret value. If not provided, the value is read from standard input.

  Short form: `-f`
</ParamField>

<ParamField path="--description" type="string">
  Optional description for the secret.

  Short form: `-d`
</ParamField>

<ParamField path="--team" type="boolean">
  Create the secret at the team level, making it available to teammates. Mutually exclusive with `--personal`.
</ParamField>

<ParamField path="--personal" type="boolean">
  Create the secret as private to your account (default). Mutually exclusive with `--team`.
</ParamField>

### Provider-specific subcommands

#### oz secret create anthropic api-key

Creates a secret that holds a direct Anthropic API key, with the correct type metadata for use by Claude harness agent runs.

```bash theme={null}
oz secret create anthropic api-key <name> [flags]
```

<ParamField path="name" type="string">
  Name of the secret (positional argument).
</ParamField>

<ParamField path="--value-file" type="string">
  Path to a file containing the API key.

  Short form: `-f`
</ParamField>

<ParamField path="--description" type="string">
  Optional description.

  Short form: `-d`
</ParamField>

#### oz secret create anthropic bedrock-api-key

Creates a secret for an Anthropic API key accessed via Amazon Bedrock.

```bash theme={null}
oz secret create anthropic bedrock-api-key <name> [flags]
```

<ParamField path="--bedrock-api-key" type="string">
  Bedrock API key. If not provided, the CLI prompts interactively.
</ParamField>

<ParamField path="--region" type="string">
  AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.
</ParamField>

#### oz secret create anthropic bedrock-access-key

Creates a secret for Anthropic Bedrock authentication using AWS access keys.

```bash theme={null}
oz secret create anthropic bedrock-access-key <name> [flags]
```

<ParamField path="--access-key-id" type="string">
  AWS access key ID. If not provided, the CLI prompts interactively.
</ParamField>

<ParamField path="--secret-access-key" type="string">
  AWS secret access key. If not provided, the CLI prompts interactively.
</ParamField>

<ParamField path="--session-token" type="string">
  AWS session token. If not provided, the CLI prompts interactively.
</ParamField>

<ParamField path="--region" type="string">
  AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.
</ParamField>

### Examples

```bash theme={null}
# Create a secret by piping a value from stdin
echo "my-secret-value" | oz secret create my-database-password

# Create a secret by reading from a file
oz secret create my-api-key --value-file ./api-key.txt

# Create a secret with a description
oz secret create stripe-webhook-secret \
  --description "Stripe webhook signing secret for production" \
  --value-file ./stripe-secret.txt

# Create an Anthropic API key secret
oz secret create anthropic api-key my-claude-key --value-file ./claude-key.txt

# Create an Anthropic Bedrock access key secret interactively
oz secret create anthropic bedrock-access-key my-bedrock-creds
```

***

## oz secret update

Updates an existing secret. You can update the value, the description, or both. Renaming or moving secrets is not supported.

```bash theme={null}
oz secret update <name> [flags]
```

### Arguments

| Argument | Description                  |
| -------- | ---------------------------- |
| `name`   | Name of the secret to update |

### Flags

<ParamField path="--value" type="boolean">
  Prompt for a new value for the secret interactively.
</ParamField>

<ParamField path="--value-file" type="string">
  Path to a file whose contents become the new secret value.

  Short form: `-f`
</ParamField>

<ParamField path="--description" type="string">
  New description for the secret. If omitted, the description is not changed.

  Short form: `-d`
</ParamField>

### Examples

```bash theme={null}
# Update a secret's value from a file
oz secret update my-api-key --value-file ./new-key.txt

# Update only the description
oz secret update my-api-key --description "Rotated 2024-06-01"

# Prompt interactively for a new value
oz secret update my-api-key --value
```

***

## oz secret delete

Deletes a secret from the managed store.

```bash theme={null}
oz secret delete <name> [flags]
```

### Arguments

| Argument | Description                  |
| -------- | ---------------------------- |
| `name`   | Name of the secret to delete |

### Flags

<ParamField path="--force" type="boolean">
  Delete without asking for confirmation.
</ParamField>

### Examples

```bash theme={null}
oz secret delete old-api-key
oz secret delete old-api-key --force
```

***

## oz secret list

Lists all secrets in the managed store. Secret values are never shown — only names and metadata.

```bash theme={null}
oz secret list
```

### Examples

```bash theme={null}
oz secret list
oz secret list --output-format json
```