Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.amika.dev/llms.txt

Use this file to discover all available pages before exploring further.

Amika has two kinds of secrets:
  • Generic secrets — arbitrary KEY=VALUE pairs you can reference from .amika/config.toml or inject as sandbox env vars.
  • Provider secrets — Claude Code / Codex credentials that get auto-injected into sandboxes so the agent runs without re-authenticating.
This guide covers both.

​
Prerequisites

  • The CLI logged in (amika auth login), or an Amika API key for the SDK.
  • For Claude / Codex pushes: the relevant credentials available on your local machine (config files, keychain, or in your environment).

​
Push a generic secret

Generic secrets are scoped to your user (user) or your org (org). 
# Inline KEY=VALUE
amika secret push DATABASE_URL=postgres://...

# From specific env vars on your shell
amika secret push --from-env DATABASE_URL,REDIS_URL

# From a .env file
amika secret push --from-file .env

# Org-scoped (visible to your whole org)
amika secret push API_KEY=sk-... --scope org
The server does not expose a deleteSecret endpoint for generic secrets. You can create, list, and update them, but you can’t delete one once it’s been pushed. Provider secrets (Claude / Codex) can be deleted.

​
Push a Claude credential

Pushed Claude credentials are auto-injected into new sandboxes — no in-sandbox login required. 
# Auto-detect and push an OAuth credential (preferred)
amika secret claude push --type oauth

# Push an API key
amika secret claude push --type api_key

# From a specific credentials file
amika secret claude push --from-file ~/.claude/.credentials.json

# Or pass the value inline
amika secret claude push --type api_key --value sk-ant-...

​
Push a Codex credential

Same shape as Claude — only the provider segment changes. 
amika secret codex push --type oauth

# API key
amika secret codex push --type api_key --value sk-...

​
Extract local credentials (CLI only)

The CLI ships an extractor that scans your filesystem for Claude, Codex, OpenCode, and Amp credentials and either prints them or pushes them straight to the vault. 
# Print what was discovered
amika secret extract

# Push everything that was discovered, after confirmation
amika secret extract --push

# Push only specific keys
amika secret extract --push --only ANTHROPIC_API_KEY,OPENAI_API_KEY

# Skip OAuth sources
amika secret extract --no-oauth
See Reference — Secrets for the full source-priority table.

​
List and delete

# Generic secrets — list only (no delete in CLI today)
# Use the web UI to inspect generic secrets.

# Provider secrets
amika secret claude list
amika secret claude delete <id>

amika secret codex list
amika secret codex delete <id>

​
Next steps

Inject credentials into a sandbox

Secrets reference

Repository configuration