Skip to main content
A secret is a catalog resource that stores a sensitive value — an API key, access token, or credential — for your tenant. Secrets are encrypted at rest and injected as environment variables on every agent VM in the tenant’s workspaces. Secret values are write-only. You can set and delete them, but you cannot read them back. Listing secrets returns names and metadata only.

​
Fields

NameTypeRequiredDescription
namestringyesSecret name. Must match [A-Z][A-Z0-9_]* — uppercase letters, digits, and underscores, starting with a letter.
plaintext_valuebytesyes (on write)The secret value. Write-only — cleared after encryption and never returned by reads or listings.
created_attimestampno (read-only)Timestamp of when the secret was created. Set automatically on creation.
descriptionstringnoHuman-readable description shown in the dashboard. Maximum 1024 bytes.
The name field doubles as the environment variable name on agent VMs. A secret named NPM_TOKEN is available to agents as $NPM_TOKEN.

​
Reserved names

Two categories of names are rejected:
PatternReason
MURMUR_*Reserved for internal use. Any name starting with MURMUR_ is rejected.
GH_TOKENAutomatically populated from the spawning developer’s GitHub token. Cannot be set or deleted as a tenant secret.

​
CLI shorthand

The murmur secret set commands provide a shorthand for managing secrets without constructing catalog payloads manually.
CommandDescription
murmur secret setSet a secret. Reads the value from stdin.
murmur secret lsList all secret names.
murmur secret rmDelete a secret.

​
Examples

​
Setting a secret

Pipe the value through stdin: 
echo "sk-ant-abc123" | murmur secret set ANTHROPIC_API_KEY

Set secret "ANTHROPIC_API_KEY"

​
Setting a secret with a description

Using the catalog API directly: 
cat <<'EOF' | murmur set secret DATADOG_API_KEY
{
  "name": "DATADOG_API_KEY",
  "plaintext_value": "dd-abc123",
  "description": "Datadog API key for agent metrics"
}
EOF

​
Listing secrets

murmur secret ls

ANTHROPIC_API_KEY
DATADOG_API_KEY
NPM_TOKEN

​
Deleting a secret

murmur secret rm NPM_TOKEN

Deleted secret "NPM_TOKEN"

​
Errors

CodeMeaningWhat to do
INVALID_ARGUMENTsecret name "foo" must match [A-Z][A-Z0-9_]*Use uppercase letters, digits, and underscores only. The name must start with a letter.
INVALID_ARGUMENTsecret name "MURMUR_X" is reserved (MURMUR_* is internal)Choose a name that does not start with MURMUR_.
INVALID_ARGUMENTsecret name "GH_TOKEN" is reserved — it is automatically populated from the developer profileGH_TOKEN is provided automatically. You do not need to set it.
INVALID_ARGUMENTplaintext_value is requiredThe write request is missing the secret value. Provide plaintext_value.
INVALID_ARGUMENTdescription exceeds 1024 byte limitShorten the description field to 1024 bytes or fewer.
INVALID_ARGUMENTsecret name "GH_TOKEN" is reserved and cannot be deletedReserved secrets cannot be deleted.