Tenant secrets
Tenant secrets are shared across your team. You create them withmurmur secret set, and a workspace delivers one to its agent VMs by declaring it in runtime_secret_mounts: as an environment variable (MOUNT_TYPE_ENV) or a file on disk (MOUNT_TYPE_FILE).
Values are never displayed: murmur secret ls shows each secret’s name, its declared kind, and an identifying hint (such as the value’s last few characters) when you set it with --kind.
Developer secrets
Developer secrets are per-developer credentials. Your GitHub token, Claude token, API keys, and SSH signing key. They are encrypted to your identity, so only your agents can use them.murmur setup gathers and encrypts these automatically. You do not manage them individually.
Spawn-time secrets
Pass one-off credentials to a single agent at spawn time with the-e flag on murmur spawn. These are encrypted before delivery and exist only for the lifetime of that agent. They do not persist to the catalog.
Credential rotation
murmur rekey re-encrypts and re-delivers your credentials to a running agent’s VM and all its children, without restarting the agent.