Skip to main content

​
Overview

The Secrets Manager lets you store sensitive values (API keys, tokens, passwords) that agents can use without seeing the raw values.

​
Creating Secrets

await rt.secrets.set('DATABASE_URL', 'postgres://user:pass@host/db');
await rt.secrets.set('OPENAI_KEY', 'sk-...');
await rt.secrets.set('STRIPE_KEY', 'sk_live_...');

​
Using Secrets

​
In Deployments

Configure which secrets a deployment can access: 
const deployment = await rt.deployments.create({
  runtimeSlug: 'my-agent',
  templateSlug: 'nodejs-20',
  apiSlug: 'my-bot',
  secrets: ['DATABASE_URL', 'STRIPE_KEY'],  // Only these
});

​
In Sandbox Commands

await sandbox.exec('node app.js', {
  secrets: ['DATABASE_URL', 'API_KEY'],
});

// Inside the sandbox:
// process.env.DATABASE_URL = 'postgres://...'
// process.env.API_KEY = 'abc123'

​
In Agent Logs

Agents see masked values: 
[thinking] Connecting to database...
[tool] bash: node app.js
   DATABASE_URL=<secret:database_url>
[result] Connected successfully

​
Managing Secrets

// List secrets (names only, not values)
const secrets = await rt.secrets.list();
// → ['DATABASE_URL', 'OPENAI_KEY', 'STRIPE_KEY']

// Check if secret exists
const exists = await rt.secrets.exists('DATABASE_URL');

// Delete secret
await rt.secrets.delete('OLD_KEY');

// Update secret
await rt.secrets.set('DATABASE_URL', 'new-connection-string');

​
Parameter Injection

Pass runtime parameters to agents: 
const run = await rt.agents.run('my-bot', {
  message: 'Process order #1234',
  params: {
    orderId: '1234',
    userId: 'user-abc',
    customerId: 'cus_xyz',
  },
});

// Agent has access to params in context

​
Secret Scopes

Restrict secrets to specific environments: 
await rt.secrets.set('DATABASE_URL', 'prod-connection', {
  scope: 'production',
});

await rt.secrets.set('DATABASE_URL', 'test-connection', {
  scope: 'test',
});

// Deployment uses appropriate secret based on environment

​
Security

​
Encryption

  • Secrets are encrypted at rest using AES-256
  • Decrypted only when needed during execution
  • Never stored in logs or transmitted to clients

​
Access Control

  • Secrets are scoped to your organization
  • Only authorized deployments can access secrets
  • Audit log tracks all secret access

​
Rotation

// Update without downtime
await rt.secrets.set('DATABASE_URL', 'new-connection');

// Deployments automatically use new value

​
CLI Reference

# Set secret
runtools secret set DATABASE_URL "postgres://..."

# List secrets
runtools secret list
# → DATABASE_URL
# → OPENAI_KEY
# → STRIPE_KEY

# Check if exists
runtools secret exists DATABASE_URL
# → true

# Delete secret
runtools secret delete OLD_KEY

​
Best Practices

DATABASE_URL not DB. STRIPE_SECRET_KEY not SK.
Update secrets periodically, especially after team changes.
Only grant secrets to deployments that need them.
Separate production and test secrets.
Ensure your code doesn’t accidentally log secret values.