Secrets

Amika stores two kinds of secrets in the vault. This page is the reference; for a walkthrough see Manage secrets.

Generic vs provider secrets

	Generic secrets	Provider secrets
What	Arbitrary `KEY=VALUE` pairs	Claude / Codex credentials
Used by	`.amika/config.toml` `{ secret = "name" }`, `--secret env:...`	Auto-injected agent credentials
Create	`amika secret push`, `createSecret`	`amika secret claude\|codex push`, `createProviderSecret`
List	`amika secret` (web UI), `listSecrets`	`amika secret claude\|codex list`, `listProviderSecrets`
Update	`updateSecret(id, { value })`	re-push
Delete	`DELETE /secrets/{id}` (see below)	`amika secret claude\|codex delete`, `deleteProviderSecret`

Generic secrets support deletion over the HTTP API with DELETE /secrets/{id}. There is no deleteSecret method in the TypeScript SDK yet, and the web UI does not expose a delete button, so today deletion is HTTP-API-only.

Scope model

Generic secrets and extracted secrets carry a scope:

Scope	Visibility
`user` (default)	Private to you
`org`	Visible to everyone in your org

amika secret push API_KEY=sk-... --scope org

`amika secret push`

Push generic secrets from inline arguments, environment variables, or a .env file.

amika secret push ANTHROPIC_API_KEY=sk-ant-xxx
amika secret push --from-env ANTHROPIC_API_KEY,OPENAI_API_KEY
amika secret push --from-file .env

Flag	Default	Description
`--from-env <keys>`		Comma-separated env var names to read and push
`--from-file <path>`		Path to a `.env` file with `KEY=VALUE` lines
`--scope <scope>`	`user`	`user` (private) or `org` (org-visible)

When multiple sources are used, positional arguments override --from-file values, and --from-env overrides both.

`amika secret extract`

Discover locally stored credentials and optionally push them to the vault. Shares its discovery logic with amika auth extract.

amika secret extract
amika secret extract --push
amika secret extract --push --only ANTHROPIC_API_KEY,OPENAI_API_KEY

Flag	Default	Description
`--push`	`false`	Push discovered secrets after confirmation
`--only <keys>`		Comma-separated names to include
`--scope <scope>`	`user`	`user` or `org`
`--homedir <path>`		Override home directory for discovery
`--no-oauth`	`false`	Skip OAuth credential sources

`amika secret claude` / `amika secret codex`

Manage provider credentials. Both share the same shape; only the provider segment differs.

`push`

# Auto-detect OAuth (preferred)
amika secret claude push --type oauth

# API key
amika secret claude push --type api_key --value sk-ant-xxx

# From a file
amika secret codex push --from-file ~/.codex/auth.json

Flag	Default	Description
`--name <label>`		Human-readable label (prompted if omitted)
`--value <string>`		Credential value (skips discovery)
`--from-file <path>`		Path to a credentials file (skips discovery)
`--type <type>`	`oauth`	`oauth` or `api_key`

--value and --from-file are mutually exclusive.

`list` / `delete`

amika secret claude list           # columns: ID, NAME, TYPE
amika secret claude delete <id>

amika secret codex list
amika secret codex delete <id>

SDK equivalents

// Generic
await amika.createSecret({ name, value, scope });
await amika.listSecrets();
await amika.updateSecret(id, { value });

// Provider ("claude" or "codex")
await amika.createProviderSecret("claude", { name, value, type: "oauth" });
await amika.listProviderSecrets("claude");
await amika.deleteProviderSecret("claude", id);

See the client reference for full signatures.

Manage secrets — task walkthrough
Inject credentials — wire secrets into sandboxes
Authentication — login and credential discovery
config.toml — { secret = "name" } references

CLI and platform

Repository configuration

HTTP API

Generic vs provider secrets

Scope model

`amika secret push`

`amika secret extract`

`amika secret claude` / `amika secret codex`

`push`

`list` / `delete`

SDK equivalents

​Generic vs provider secrets

​Scope model

​amika secret push

​amika secret extract

​amika secret claude / amika secret codex

​push

​list / delete

​SDK equivalents

​Related docs

Generic vs provider secrets

Scope model

`amika secret push`

`amika secret extract`

`amika secret claude` / `amika secret codex`

`push`

`list` / `delete`

SDK equivalents

Related docs