> ## Documentation Index
> Fetch the complete documentation index at: https://docs.murmur.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> How credentials and sensitive values are stored, encrypted at rest, decrypted in transit, and delivered to agents as environment variables.

Murmur manages three kinds of secrets — tenant-wide, per-developer, and per-spawn. All are encrypted at rest and delivered as environment variables on agent VMs.

## Tenant secrets

Tenant secrets are shared across your team. You create them with [`murmur secret set`](/cli/secret-set), and they are injected as environment variables on every agent VM in the [workspaces](/concepts/workspaces) that reference them.

Values are never displayed — [`murmur secret ls`](/cli/secret-ls) shows names only.

## Developer secrets

Developer secrets are per-developer credentials — your GitHub token, Claude token, API keys, and SSH signing key. They are encrypted to your identity, so only your agents can use them.

[`murmur setup`](/cli/setup) gathers and encrypts these automatically. You do not manage them individually.

## Spawn-time secrets

Pass one-off credentials to a single agent at spawn time with the `-e` flag on [`murmur spawn`](/cli/spawn). These are encrypted before delivery and exist only for the lifetime of that agent. They do not persist to the catalog.

## Credential rotation

[`murmur rekey`](/cli/rekey) re-encrypts and re-delivers your credentials to a running agent's VM and all its children — without restarting the agent.

***

| Type      | Page                                            |
| --------- | ----------------------------------------------- |
| Reference | [secret](/catalog/secret)                       |
| Reference | [user-secret](/catalog/user-secret)             |
| Reference | [user](/catalog/user)                           |
| Reference | [`murmur secret set`](/cli/secret-set)          |
| Reference | [`murmur rekey`](/cli/rekey)                    |
| Guide     | [Service profiles](/security/service-profile)   |
| Guide     | [VM environment](/configuration/vm-environment) |
| Concept   | [Workspaces](/concepts/workspaces)              |