Secrets

Amika stores two kinds of secrets in the vault: provider-specific secrets (ie your Claude or Codex credentials) and generic secrets (anything you set). This page is the reference — for a walkthrough see Manage secrets.

Scope model

Generic secrets and extracted secrets carry a scope:

Scope	Visibility
`user` (default)	Private to you
`org`	Visible to everyone in your org

amika secret push API_KEY=sk-... --scope org

`amika secret push`

Push generic secrets from inline arguments, environment variables, or a .env file.

amika secret push ANTHROPIC_API_KEY=sk-ant-xxx
amika secret push --from-env ANTHROPIC_API_KEY,OPENAI_API_KEY
amika secret push --from-file .env

Flag	Default	Description
`--from-env <keys>`		Comma-separated env var names to read and push
`--from-file <path>`		Path to a `.env` file with `KEY=VALUE` lines
`--scope <scope>`	`user`	`user` (private) or `org` (org-visible)

When multiple sources are used, positional arguments override --from-file values, and --from-env overrides both.

`amika secret extract`

Discover locally stored credentials and optionally push them to the vault. See Local credential discovery for the sources it checks.

amika secret extract
amika secret extract --push
amika secret extract --push --only ANTHROPIC_API_KEY,OPENAI_API_KEY

Flag	Default	Description
`--push`	`false`	Push discovered secrets after confirmation
`--only <keys>`		Comma-separated names to include
`--scope <scope>`	`user`	`user` or `org`
`--homedir <path>`		Override home directory for discovery
`--no-oauth`	`false`	Skip OAuth credential sources

`amika secret claude` / `amika secret codex`

Manage provider credentials. Both share the same shape; only the provider segment differs.

`push`

# Auto-detect OAuth (preferred)
amika secret claude push --type oauth

# API key
amika secret claude push --type api_key --value sk-ant-xxx

# From a file
amika secret codex push --from-file ~/.codex/auth.json

Flag	Default	Description
`--name <label>`		Human-readable label (prompted if omitted)
`--value <string>`		Credential value (skips discovery)
`--from-file <path>`		Path to a credentials file (skips discovery)
`--type <type>`	`oauth`	`oauth` or `api_key`

--value and --from-file are mutually exclusive.

`list` / `delete`

amika secret claude list           # columns: ID, NAME, TYPE
amika secret claude delete <id>

amika secret codex list
amika secret codex delete <id>

SDK equivalents

// Generic
await client.secrets.create({ name, value, scope });
await client.secrets.list();
await client.secrets.update(id, { value });

// Provider ("claude" or "codex")
await client.agentCredentials.create("claude", { name, value, type: "oauth" });
await client.agentCredentials.list("claude");
await client.agentCredentials.delete("claude", id);

See the client reference for full signatures.

Manage secrets — task walkthrough
Inject credentials — wire secrets into rigs
Authentication — login and credential discovery
config.toml — { secret = "name" } references

CLI and platform

Repository configuration

HTTP API

Scope model

`amika secret push`

`amika secret extract`

`amika secret claude` / `amika secret codex`

`push`

`list` / `delete`

SDK equivalents

​Scope model

​amika secret push

​amika secret extract

​amika secret claude / amika secret codex

​push

​list / delete

​SDK equivalents

​Related docs

Scope model

`amika secret push`

`amika secret extract`

`amika secret claude` / `amika secret codex`

`push`

`list` / `delete`

SDK equivalents

Related docs