Skip to main content
A user-secret is a catalog resource that holds one encrypted value scoped to a single developer. Unlike a tenant-wide secret, a user-secret is bound to the developer who created it — only agents that developer spawns receive it. User-secrets are created automatically by murmur setup when you onboard your credentials. You can also create and update them manually with murmur set.

​
Fields

The plaintext_value field is write-only. When you read a user-secret back with murmur get, the response contains name, created_at, and description — never the encrypted value.

​
Name convention

The default authorization rules grant each developer read, create, edit, and list access to user-secrets matching the pattern {provider}/{username}/*. The murmur setup command follows this convention automatically, producing names like: When creating user-secrets manually, use the same {provider}/{username}/{NAME} convention so the authorization pattern matches.

​
Examples

​
Setting a user-secret via murmur setup

murmur setup creates user-secrets automatically as part of onboarding:
This encrypts your GitHub token, signing key, and any configured API keys as user-secrets under your identity prefix.

​
Creating a user-secret manually

​
Listing your user-secrets

​
Reading a single user-secret

The response includes name, created_at, and description. The encrypted value is stripped.

​
Deleting a user-secret

Deleting a user-secret that your user record references (e.g. github_token_secret) causes agents you spawn to start without that credential. Run murmur setup again to re-create it.

​
How user-secrets reach agents

When you spawn an agent, the system reads your user record, resolves each referenced user-secret name, and includes the encrypted values in the agent’s launch payload. The well-known secret names map to environment variables on the agent VM:

​
Errors

  • Profiles and secrets — concept overview of developer profiles and secret scopes
  • secret — tenant-wide secrets shared across all developers
  • murmur set — CLI command for creating and updating catalog resources
  • murmur get — CLI command for reading catalog resources
  • murmur setup — CLI command that creates user-secrets automatically during onboarding
  • Secrets management — CLI guide for managing tenant and developer secrets
  • Encryption — how secrets are encrypted at rest and in transit
  • Permissions — default authorization bindings including the user-secrets-self grant