Manage tenant secrets
For: cluster and tenant administrators.
Secrets are stored per tenant, sealed with AES-GCM under the cluster's master key, or, once the cluster has a secrets key, with HPKE to a key that only the edges hold (roles apart). The value never comes back out of the admin API; only the edge unseals it, when it needs it.
In the console, open Credentials to Secrets to Add Secret. The form opens in a dialog; cancelling clears its value. A name must be unique in the tenant: delete the existing secret before adding another with that name. The server checks creation atomically, including simultaneous requests. Existing API and CLI calls can still explicitly rotate a value. Reminder settings opens a separate dialog for the days before expiry when reminders are sent; cancelling keeps the saved schedule.
Store a secret once for the tenant, then inspect the providers, plugins and connections that use it.
Choose a task
| Task | Guide |
|---|---|
| Bind secrets to destination hosts | Open guide |
| Test and rotate secrets | Open guide |
| Use an external secret store | Open guide |
| Deliver and scan plugin secrets | Open guide |
| Configure plugin settings | Open guide |
Set, list and delete
The value comes from stdin, an environment variable or a file, never from the command line, so it does not end up in your shell history:
printf %s "$ANTHROPIC_API_KEY" | oz0 secret set ANTHROPIC_API_KEY
oz0 secret set OPENAI_API_KEY --from-env OPENAI_API_KEY
oz0 secret set GITHUB_TOKEN --from-file ~/.secrets/github-token --tenant acme --host github.com --host api.github.com
oz0 secret list # names, versions, ages, expiries and the hosts each may go to; never values
oz0 secret delete GITHUB_TOKEN
Every change is recorded in the audit log, without the value.
What uses them today
| Secret | Used by |
|---|---|
ANTHROPIC_API_KEY | The LLM gateway, for models named anthropic/... |
OPENAI_API_KEY | The LLM gateway, for models named openai/... |
The key_secret of any other provider, such as GEMINI_API_KEY or MISTRAL_API_KEY | The LLM gateway, for that provider's models |
A provider's client secret, service account key, or AWS access key ID, secret and session token, such as AZURE_CLIENT_SECRET, GOOGLE_SERVICE_ACCOUNT_KEY, AWS_ACCESS_KEY_ID | The LLM gateway, which signs calls with them or trades them for a token on the edge (How calls are signed) |
| Any name you choose | The token for a private plugin repository or OCI registry, named with plugin install --secret; see Install and update |
Any name a plugin lists in requires.secrets | That plugin's tools, hooks and harnesses, as environment variables; see below |
Any name a plugin lists in requires.optional_secrets | The same, when the tenant has it; an address or a switch is a setting instead |
| Any name a flow's or a routine's webhook names | The edge, to check calls to the webhook; see Flows and Routines |
| Any name an event source names | The edge, to check the signature of each delivery; see Event sources |
When a model call needs a key the tenant does not have, the gateway answers 412 with the command that sets it. An agent with a fallback model on another provider falls back to it; when no model has a key, the job fails at once with MissingKey and that command. See Troubleshooting.
Who uses each one
oz0 secret usage, and the Credentials page under Admin in the console, show a tenant's credentials and who acts through them, for its admins only, and never a value (management holds none). It is also where the console sets secrets and connects connections, so each is in one place:
- every secret: who set it and when, the plugins that declare it, the model providers that read it (as a key, an access key ID or a session token), the credential bindings that inject it and where, and the connection whose steps saved it; a secret something reads that is not set yet, such as a built-in model provider's key, is listed under Read, but not set yet, and Set it puts its name in the form;
- every connection: its tools and secrets, who connected it and when, what it signs in as (the values its steps saved, such as an app or an installation), when a call last got its token, the bindings that put its token on hosts, and the plugins whose granted uses call its tools;
- credential changes that wait for another admin's decision;
- the refusals of the last 24 hours from the audit trail: secrets refused in calls, credentials or placeholders that went where no binding puts them, and egress denials of hosts a binding names.
oz0 secret usage --tenant acme
oz0 secret usage --json
A provider key that another tenant of the cluster uses too is marked there, without naming that tenant: the provider's prompt caches may be shared between the two. See Two tenants, one key.
Previous section links
Where a secret may be sent: open guide.
Rotate, test and roll back: open guide.
A provider's key is tested before it is stored: open guide.
Roll back within 24 hours: open guide.
Expiry and reminders: open guide.
Secrets in your own store: open guide.
Stores run on the edges: open guide.
Rotation in the store: open guide.
Taking a store away: open guide.
Secrets for plugins: open guide.
Secrets on a file descriptor: open guide.
What is scanned: open guide.
Settings are not secrets: open guide.
Settings kept as secrets before: open guide.