Secrets Management

This section covers all CLI commands for managing secrets used by your AI agents on Agent Cloud. Secrets allow you to securely store sensitive configuration values like API keys, database credentials, and registry authentication.

Environment Secrets

Environment secrets are key-value pairs that are securely injected as environment variables into your agent containers at runtime.

List

List all secret sets.

Usage

videosdk agent secrets list

Example Output

$ videosdk agent secrets list

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Listing Secrets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

┌──────────────────┬─────────────────┬──────────┐
│ Name             │ Secret ID       │ Type     │
├──────────────────┼─────────────────┼──────────┤
│ my-secrets       │ sec-abc123      │ env      │
│ prod-credentials │ sec-xyz789      │ env      │
└──────────────────┴─────────────────┴──────────┘

✓ Secrets listed successfully

Create

Create a new secret set.

Usage

videosdk agent secrets create <name> [OPTIONS]

Options

Option	Short	Description	Default
--file	-f	Path to .env file with key=value pairs	None (interactive mode)
--region		Region for storing secrets	None

Example Output

$ videosdk agent secrets create my-secrets --file .env

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Creating Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Secret Name: my-secrets
File: .env

Secrets to be saved:
- API_KEY: ******
- DATABASE_URL: ******

Confirm action
❯ Save secrets
  Cancel

Saving secrets...
Secrets saved successfully.

✓ Secret 'my-secrets' created successfully

Examples

# Create from .env file
videosdk agent secrets create my-secrets --file .env

# Create interactively (will prompt for key-value pairs)
videosdk agent secrets create my-secrets

# Create with specific region
videosdk agent secrets create my-secrets --file .env --region in002

Add

Add new keys to an existing secret set.

Usage

videosdk agent secrets add <name>

Example Output

$ videosdk agent secrets add my-secrets

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Adding to Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Adding secret...
Enter key: NEW_API_KEY
Enter value: ********

Add another secret?
❯ Yes
  No

Secrets to be saved:
- NEW_API_KEY: ******

Confirm action
❯ Save secrets
  Cancel

Secret added successfully.

✓ Keys added to secret 'my-secrets' successfully

Remove

Remove specific keys from a secret set.

Usage

videosdk agent secrets remove <name>

Example Output

$ videosdk agent secrets remove my-secrets

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Removing Keys from Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Removing secret...
Enter key: OLD_API_KEY
Remove another key?
❯ Yes
  No

Secret removed successfully.

Describe

Show details of a secret set (keys only, values are hidden).

Usage

videosdk agent secrets describe <name>

Example Output

$ videosdk agent secrets describe my-secrets

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Describing Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Name        my-secrets
  Secret ID   sec-abc123
  Type        env

┌──────────────────┬──────────┐
│ Key              │ Value    │
├──────────────────┼──────────┤
│ OPENAI_API_KEY   │ ******   │
│ DATABASE_URL     │ ******   │
│ SECRET_TOKEN     │ ******   │
└──────────────────┴──────────┘

Delete

Permanently delete a secret set.

Usage

videosdk agent secrets delete <name>

Example Output

$ videosdk agent secrets delete my-secrets

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Deleting Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ Secret 'my-secrets' deleted successfully

caution

This action is permanent and cannot be undone. All keys in the secret set will be deleted.

Image Pull Secrets

Image pull secrets store container registry credentials, allowing Agent Cloud to pull images from private registries.

Create Image Pull Secret

Create an image pull secret for private container registries.

Usage

videosdk agent image-pull-secret <name> [OPTIONS]

Arguments

Argument	Required	Description
name	Yes	Name for the image pull secret

Options

Option	Description	Default
--region	Region for storing the secret	None

What Happens

1. You'll be prompted for:

   • Server: Registry URL (e.g., ghcr.io, docker.io)
   • Username: Registry username
   • Password: Registry password or access token

2. Credentials are securely stored and can be referenced in deployments

Example Output

$ videosdk agent image-pull-secret my-registry-creds

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Creating Image Pull Secret
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Setting image pull secret...
Secret Name: my-registry-creds
Enter server url: ghcr.io
Enter username: myusername
Enter password: ********

Image pull secret set successfully.

✓ Image pull secret 'my-registry-creds' created successfully

Examples

# Create image pull secret for GitHub Container Registry
videosdk agent image-pull-secret ghcr-secret

# Create with specific region
videosdk agent image-pull-secret my-registry-creds --region in002

Using Secrets in Deployments

Once you've created secrets, you can reference them when deploying your agent:

Environment Secrets

videosdk agent deploy --image myrepo/myagent:v1 --env-secret my-secrets

Image Pull Secrets

videosdk agent deploy --image ghcr.io/myorg/myagent:v1 --image-pull-secret ghcr-secret

Combined Example

videosdk agent deploy \
  --image ghcr.io/myorg/myagent:v1 \
  --env-secret prod-credentials \
  --image-pull-secret ghcr-secret \
  --min-replica 2 \
  --max-replica 10

Quick Reference

Command	Description
videosdk agent secrets list	List all secret sets
videosdk agent secrets create <name>	Create a new secret set
videosdk agent secrets add <name>	Add keys to a secret
videosdk agent secrets remove <name>	Remove keys from a secret
videosdk agent secrets describe <name>	Show secret details
videosdk agent secrets delete <name>	Delete a secret set
videosdk agent image-pull-secret <name>	Create registry credentials

Best Practices

1. Use .env files for bulk creation: When you have many secrets, create a .env file and use --file .env

2. Separate secrets by environment: Create different secret sets for development, staging, and production

3. Rotate secrets regularly: Delete and recreate secrets periodically for security

4. Use descriptive names: Name your secrets clearly (e.g., prod-api-keys, staging-db-creds)