Secrets

Manage tenant secrets and runtime secret-injection stubs.

SecretManager declaration

class SecretManager

SecretManager access

This type is created by the SDK; do not construct it directly.

const manager = client.secrets;

SecretManager methods

delete()

Delete a tenant secret by UUID or display name.

SecretManager.delete(name: string): Promise<void>

Parameters

Name	Type	Default	Description
name	string	Required	Resource display name.

Returns

• Promise<void>

deleteDefaultSecretStub()

Delete a tenant-default secret-injection stub by UUID.

SecretManager.deleteDefaultSecretStub(id: string): Promise<void>

Parameters

Name	Type	Default	Description
id	string	Required	Resource UUID or display name.

Returns

• Promise<void>

deleteSecretStub()

Delete a secret-injection stub by UUID.

SecretManager.deleteSecretStub(id: string): Promise<void>

Parameters

Name	Type	Default	Description
id	string	Required	Resource UUID or display name.

Returns

• Promise<void>

get()

Resolve a tenant secret by UUID or display name.

SecretManager.get(name: string): Promise<SecretInfo>

Parameters

Name	Type	Default	Description
name	string	Required	Resource display name.

Returns

• Promise<SecretInfo>

list()

List tenant secrets.

SecretManager.list(): Promise<SecretInfo[]>

Returns

• Promise<SecretInfo[]>

listDefaultSecretStubs()

List tenant-default secret-injection stubs.

SecretManager.listDefaultSecretStubs(): Promise<DefaultSecretStubInfo[]>

Returns

• Promise<DefaultSecretStubInfo[]>

listSecretStubs()

List secret-injection stubs across the tenant.

SecretManager.listSecretStubs(): Promise<SecretStubInfo[]>

Returns

• Promise<SecretStubInfo[]>

set()

Create or replace a tenant secret.

SecretManager.set(
  name: string,
  value: string,
  options: { cacheTtlSecs?: number } = {},
): Promise<SecretInfo>

Parameters

Name	Type	Default	Description
name	string	Required	Secret display name.
value	string	Required	Secret value.
options	{ cacheTtlSecs?: number }	{}	Optional cache lifetime settings.

Returns

• Promise<SecretInfo> — Metadata for the stored secret.

Examples

const secret = await client.secrets.set("github-token", process.env.GITHUB_TOKEN!);

setDefaultSecretStub()

Create or replace a tenant-default secret-injection stub.

SecretManager.setDefaultSecretStub(
  url: string,
  pathOrOptions?: string | { config?: SecretStubConfig | Record<string, string> | null; path?: string | null } | null,
  configArg?: SecretStubConfig | Record<string, string> | null,
): Promise<DefaultSecretStubInfo>

Parameters

Name	Type	Default	Description
url	string	Required	URL whose credentials should be injected.
pathOrOptions?	string | { config?: SecretStubConfig | Record<string, string> | null; path?: string | null } | null	Optional	Secret-stub path or structured options.
configArg?	SecretStubConfig | Record<string, string> | null	Optional	Legacy secret-stub configuration argument.

Returns

• Promise<DefaultSecretStubInfo>

RuntimeSecretManager

Configures and inspects secret-injection stubs for one runtime.

RuntimeSecretManager declaration

class RuntimeSecretManager

RuntimeSecretManager access

This type is created by the SDK; do not construct it directly.

const manager = runtime.secrets;

RuntimeSecretManager methods

deleteSecretStub()

Delete a runtime secret-injection stub by UUID.

RuntimeSecretManager.deleteSecretStub(id: string): Promise<void>

Parameters

Name	Type	Default	Description
id	string	Required	Resource UUID or display name.

Returns

• Promise<void>

getSecretStub()

Resolve a runtime secret-injection stub by UUID.

RuntimeSecretManager.getSecretStub(id: string): Promise<SecretStubInfo>

Parameters

Name	Type	Default	Description
id	string	Required	Resource UUID or display name.

Returns

• Promise<SecretStubInfo>

listSecretStubs()

List secret-injection stubs for this runtime.

RuntimeSecretManager.listSecretStubs(): Promise<SecretStubInfo[]>

Returns

• Promise<SecretStubInfo[]>

setSecretStub()

Create or replace a secret-injection stub for this runtime.

RuntimeSecretManager.setSecretStub(
  url: string,
  pathOrOptions?: string | { config?: SecretStubConfig | Record<string, string> | null; path?: string | null } | null,
  configArg?: SecretStubConfig | Record<string, string> | null,
): Promise<SecretStubInfo>

Parameters

Name	Type	Default	Description
url	string	Required	URL whose credentials should be injected.
pathOrOptions?	string | { config?: SecretStubConfig | Record<string, string> | null; path?: string | null } | null	Optional	Secret-stub path or structured options.
configArg?	SecretStubConfig | Record<string, string> | null	Optional	Legacy secret-stub configuration argument.

Returns

• Promise<SecretStubInfo>