Skip to main content
Warp’s managed secret store lets you upload sensitive credentials — such as API keys, database passwords, or cloud provider access keys — and have them injected automatically into your cloud agent containers at runtime. The oz secret command group provides full CRUD operations on secrets. Secrets can be scoped to a personal account or a team.

​
Synopsis

oz secret <subcommand> [flags]

​
Subcommands

SubcommandDescription
create [name]Create a new secret
update <name>Update an existing secret’s value or description
delete <name>Delete a secret
listList all secrets

​
oz secret create

Creates a new secret. You can create a generic raw-value secret, or use a provider-specific subcommand (such as anthropic api-key) to create a typed secret with the correct structure. 
oz secret create [name] [flags]
oz secret create anthropic api-key <name> [flags]
oz secret create anthropic bedrock-api-key <name> [flags]
oz secret create anthropic bedrock-access-key <name> [flags]
If you do not pass a value via --value-file, the CLI reads the secret value from standard input.

​
Flags (generic create)

​
name
string
Name of the secret to create (positional argument).
​
--type
string
default:"raw-value"
Secret type. Accepted values: raw-value, anthropic-api-key.Short form: -t
​
--value-file
string
Path to a file whose contents become the secret value. If not provided, the value is read from standard input.Short form: -f
​
--description
string
Optional description for the secret.Short form: -d
​
--team
boolean
Create the secret at the team level, making it available to teammates. Mutually exclusive with --personal.
​
--personal
boolean
Create the secret as private to your account (default). Mutually exclusive with --team.

​
Provider-specific subcommands

​
oz secret create anthropic api-key

Creates a secret that holds a direct Anthropic API key, with the correct type metadata for use by Claude harness agent runs. 
oz secret create anthropic api-key <name> [flags]
​
name
string
Name of the secret (positional argument).
​
--value-file
string
Path to a file containing the API key.Short form: -f
​
--description
string
Optional description.Short form: -d

​
oz secret create anthropic bedrock-api-key

Creates a secret for an Anthropic API key accessed via Amazon Bedrock. 
oz secret create anthropic bedrock-api-key <name> [flags]
​
--bedrock-api-key
string
Bedrock API key. If not provided, the CLI prompts interactively.
​
--region
string
AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.

​
oz secret create anthropic bedrock-access-key

Creates a secret for Anthropic Bedrock authentication using AWS access keys. 
oz secret create anthropic bedrock-access-key <name> [flags]
​
--access-key-id
string
AWS access key ID. If not provided, the CLI prompts interactively.
​
--secret-access-key
string
AWS secret access key. If not provided, the CLI prompts interactively.
​
--session-token
string
AWS session token. If not provided, the CLI prompts interactively.
​
--region
string
AWS region for the Bedrock endpoint. If not provided, the CLI prompts interactively.

​
Examples

# Create a secret by piping a value from stdin
echo "my-secret-value" | oz secret create my-database-password

# Create a secret by reading from a file
oz secret create my-api-key --value-file ./api-key.txt

# Create a secret with a description
oz secret create stripe-webhook-secret \
  --description "Stripe webhook signing secret for production" \
  --value-file ./stripe-secret.txt

# Create an Anthropic API key secret
oz secret create anthropic api-key my-claude-key --value-file ./claude-key.txt

# Create an Anthropic Bedrock access key secret interactively
oz secret create anthropic bedrock-access-key my-bedrock-creds

​
oz secret update

Updates an existing secret. You can update the value, the description, or both. Renaming or moving secrets is not supported. 
oz secret update <name> [flags]

​
Arguments

ArgumentDescription
nameName of the secret to update

​
Flags

​
--value
boolean
Prompt for a new value for the secret interactively.
​
--value-file
string
Path to a file whose contents become the new secret value.Short form: -f
​
--description
string
New description for the secret. If omitted, the description is not changed.Short form: -d

​
Examples

# Update a secret's value from a file
oz secret update my-api-key --value-file ./new-key.txt

# Update only the description
oz secret update my-api-key --description "Rotated 2024-06-01"

# Prompt interactively for a new value
oz secret update my-api-key --value

​
oz secret delete

Deletes a secret from the managed store. 
oz secret delete <name> [flags]

​
Arguments

ArgumentDescription
nameName of the secret to delete

​
Flags

​
--force
boolean
Delete without asking for confirmation.

​
Examples

oz secret delete old-api-key
oz secret delete old-api-key --force

​
oz secret list

Lists all secrets in the managed store. Secret values are never shown — only names and metadata. 
oz secret list

​
Examples

oz secret list
oz secret list --output-format json

Build docs developers (and LLMs) love

Get started for freeTalk to us