Secrets

The values an agent workflow references as ${{secrets.KEY}}.

:::caution Write-only The value is never returned by any command — not even right after you wrote it. If you'll need the credential elsewhere, keep it before storing it here. :::

See the Secret model.

Command	HTTP	Description
`secrets list`	`GET /secrets`	List the workspace secrets — `key`, `notes`, `last_used_at` and timestamps only.
`secrets get`	`GET /secrets/{id}`	Fetch one secret's metadata. The value is not part of the response.
`secrets create`	`POST /secrets`	Store a new secret. A duplicate `key` is refused with `409`.
`secrets upsert`	`PUT /secrets`	Create the secret, or rotate the value of an existing one with the same `key`.
`secrets update`	`PATCH /secrets/{id}`	Replace a value or its notes. `key` is immutable.
`secrets delete`	`DELETE /secrets/{id}`	Soft-delete. Any workflow step referencing the key fails from the next run on.

Examples

# List
kobana inbox secrets list --fields "id,key,notes,last_used_at"

# Get metadata
kobana inbox secrets get --params '{"id": "SECRET_ID"}'

# Create
kobana inbox secrets create \
  --json '{"key": "ERP_API_TOKEN", "value": "sk_live_...", "notes": "ERP integration token"}'

# Rotate by key, no lookup needed
kobana inbox secrets upsert \
  --json '{"key": "ERP_API_TOKEN", "value": "sk_live_new..."}'

# Replace the value
kobana inbox secrets update \
  --params '{"id": "SECRET_ID"}' \
  --json '{"value": "sk_live_rotated..."}'

# Soft-delete
kobana inbox secrets delete --params '{"id": "SECRET_ID"}' --dry-run

Next steps

Agents — the workflow that references a secret's key.

Examples​

Next steps​

Examples

Next steps