Set and manage workspace or personal secrets.
Personal secrets belong to the caller across workspaces. Workspace secrets are shared resources. Listings include stored values only for workspace secrets marked visible (unredacted); all other entries contain metadata.
sim secrets is also spelled sim secret.
These commands accept the global options.
List secrets
OAuth login or personal API key required.
sim secrets list [options]Options
| Option | Required | Description |
|---|---|---|
--scope <value> | No | Restrict results to one ownership scope. Accepted values: workspace, personal. |
--search <value> | No | Case-insensitive substring match against the secret name. |
--sort-by <value> | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by name. Defaults to "name". Accepted values: name, createdAt, updatedAt. |
--sort-order <value> | No | Sort direction. Defaults to "asc". Accepted values: asc, desc. |
--limit <n> | No | Maximum items to return (0 for everything). Defaults to 0. |
API request and response schemas: listSecrets.
Create or replace a named secret, such as an API key or environment variable
OAuth login or personal API key required.
sim secrets set <name> [options]Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret name, as referenced in workflows |
Options
| Option | Required | Description |
|---|---|---|
--scope <scope> | Yes | Secret ownership scope. Accepted values: workspace, personal. |
--value <value|@file> | No | Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one. |
--description <description> | No | What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged. |
--unredacted | No | Opt the workspace secret out of redaction: its value then appears in plaintext in run logs, model-visible content, and files, including publicly shared log links. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave the current setting untouched. Pass --no-unredacted to restore redaction. |
--no-unredacted | No | Send --unredacted as false. |
Omit --value to enter it privately in a terminal. For an existing workspace secret, passing only --description or a redaction flag keeps the stored value and does not prompt. Personal secrets always require a value; they accept no writable metadata. In scripts, pass --value @path or --value @-.
API request and response schemas: setSecret.
Delete secret
OAuth login or personal API key required.
This deletes the secret; anything using it may stop working.
sim secrets delete <name> [options]Arguments
| Argument | Required | Description |
|---|---|---|
name | Yes | Secret to delete. |
Options
| Option | Required | Description |
|---|---|---|
--scope <value> | Yes | Whether the secret belongs to the workspace or to the caller. A personal secret belongs to the caller across every workspace, not to one workspace. Accepted values: workspace, personal. |
-y, --yes | Yes | Confirm this operation. |
API request and response schemas: deleteSecret.