secrets is the one plural noun; secret is a hidden alias. It is the same vault the dashboard’s Secrets page writes, reached with your API key.
The same three operations exist on the SDK’s Evolve.managedSecrets().
A read-only API key may list but not set or delete (read_only_key). LLM provider keys cannot be stored here; they decide who pays and stay on the dashboard.
secrets set
secret_exists, 409): delete first, or use another label. Never a silent overwrite. NAME matches [A-Z_][A-Z0-9_]{0,127}, uppercased for you; the EVOLVE_ prefix is reserved.
value
The secret value, at most 190 bytes of UTF-8. Omit it to pipe the value on stdin, which keeps it out of shell history; one trailing newline is stripped from the pipe. A terminal with neither channel is a usage error, never a hang.
label
default:"default"
Labeled-row identity, at most 80 characters of
[A-Za-z0-9._-]. Several values of one name live side by side.mode
required
brokered: the value never enters a sandbox, and needs the --allowed-* scoping. direct: the raw value in the sandbox env; scoping refused.host
Brokered scoping: a hostname, or a wildcard like
*.example.com. Repeatable./prefix
Brokered scoping: an allowed URL path prefix. Repeatable.
METHOD
Brokered scoping: an allowed HTTP method. Repeatable.
secrets list
keys | all | help
Choose and order columns, comma-separated.
help lists the keys.Print only
name[:label], one per line.Full cell content instead of one-line truncation.
Omit the header row in piped (TSV) output.
secrets delete
delete then set, or store the new value under another label.
label
The labeled row to delete. Omitted, it resolves as an attachment does: the
default row, else the only row, else refused with secret_ambiguous naming every label.Global options
Machine-readable JSON output.
key
API key. Defaults to
$EVOLVE_API_KEY.url
API base URL. Defaults to the Evolve dashboard API.