evolve secrets

Store a value once, then attach its name to a job. Reads return metadata, never the stored value. Set EVOLVE_API_KEY to a full-access key before storing or deleting secrets. Set GITHUB_TOKEN in your shell to the credential you want the evaluated agent to use:

printf %s "$GITHUB_TOKEN" | evolve secrets set GITHUB_TOKEN \
  --delivery direct

Creating the secret prints Stored env secret GITHUB_TOKEN (label default, delivery direct). Piping keeps the value out of the command’s arguments.

Choose delivery

Mode	What enters the sandbox
`direct`	The raw value as an environment variable.
`brokered`	A reference used through the credential proxy. The stored value stays outside the sandbox.

Managed evaluations require direct. Attaching a brokered secret to an evaluation returns secret_brokered_unsupported. Brokered delivery is available for supported Agent SDK workloads. It requires at least one allowed host, path prefix, and method. Direct delivery rejects these scoping options.

Store a brokered secret for an Agent SDK workload

printf %s "$GITHUB_TOKEN" | evolve secrets set GITHUB_TOKEN_BROKERED \
  --delivery brokered \
  --allowed-host api.github.com \
  --allowed-path-prefix / \
  --allowed-method GET

See Secrets for evaluation delivery behavior.

Store a secret

To store a labeled value, set SERVICE_TOKEN in your shell and run:

printf %s "$SERVICE_TOKEN" | evolve secrets set SERVICE_TOKEN \
  --label staging \
  --delivery direct

Option	Meaning
`--value <value>`	Nonempty value, at most 190 UTF-8 bytes. If omitted, read piped stdin and remove one trailing newline.
`--label <label>`	Label under this name. Default `default`. At most 80 letters, numbers, dots, underscores, or hyphens.
`--delivery <brokered\|direct>`	Required delivery mode.
`--allowed-host <host>`	Allowed hostname or wildcard. Repeatable.
`--allowed-path-prefix <path>`	Allowed URL path prefix. Repeatable.
`--allowed-method <method>`	`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, or `HEAD`. Repeatable.

Names are converted to uppercase and must match [A-Z_][A-Z0-9_]{0,127}. The EVOLVE_ prefix is reserved. An empty value, or an interactive terminal with neither --value nor piped input, is a usage error.

Brokered scope limits

Each scope list accepts at most 50 entries. Hosts must be hostnames or wildcard hostnames such as *.example.com, without a URL scheme, port, or path. Each host is at most 253 characters, with at most 63 characters in each part between dots.Path prefixes start with / and contain at most 512 characters. Encoded slashes and .. path segments are rejected. Hosts are normalized to lowercase; methods to uppercase.

Restating the same value can update delivery or scoping. A different value under the same name and label is refused with secret_exists; use a new label or delete the old row first.

Attach it to a job

Use a job configuration file that selects your tasks and agents:

evolve run -c job.yaml --secret GITHUB_TOKEN
evolve run -c job.yaml --secret SERVICE_TOKEN@staging=APP_TOKEN

The second example selects label staging and exposes it under APP_TOKEN. See Run options for --secret and --secret-inline. Without a label, Evolve selects default, or the only label if exactly one exists. If several labels exist without default, specify one to resolve secret_ambiguous.

List metadata

evolve secrets list
evolve secrets list --json

Option	Meaning
`--columns <keys\|all\|help>`	Select metadata columns.
`-q`, `--quiet`	Print names, with `:label` for non-default labels.
`--no-trunc`	Keep full terminal table cells.
`--no-headers`	Omit piped TSV headers.

The list returns enabled secrets and has no pagination flags. A read-only API key can list metadata.

Delete

evolve secrets delete SERVICE_TOKEN --label staging

--label <label> selects the value to delete. Without it, deletion uses the same label selection rules as attachment. Existing brokered access to that value is revoked. This command has no confirmation prompt. Deleting a secret needed by an unfinished job can make later trials fail.

JSON output

Add --json to any secrets command. Values are never included.

Command	JSON output
`set`	`{ status, secret }`. `status` is `created` or `updated`; `secret` is metadata.
`list`	`{ secrets }`, where `secrets` is an array of metadata objects.
`delete`	`{ ok, name, label }`.

See secret response fields for metadata fields. Storing or deleting with a read-only key returns 403 read_only_key. A different value under an existing name and label returns 409 secret_exists; deleting a name or label that does not exist returns 404 secret_not_found. Global options apply.

Start work

Inspect results

Manage resources