Secrets

In a program

A program declares the secrets it uses with #[program(secrets = ["example"])], and writes {secret:example} in a header value of an outgoing request. The host substitutes the value, and the program never holds it.

let page = berm_lang::http::fetch(
    "GET",
    "https://api.example.com/items",
    &[("Authorization", "Bearer {secret:example}")],
    b"",
)?;

A request naming a secret the program does not declare, or one that is not set, is refused before anything is sent.

Setting one

Route	Does
PUT /services/{owner}/{name}/secrets/{secret}	Sets it from {"value": "…"}. 409 if it is already set.
GET /services/{owner}/{name}/secrets	Lists names and when each was set. Values are never returned.
DELETE /services/{owner}/{name}/secrets/{secret}	Revokes it.

• Only owners manage secrets.
• A set secret cannot be changed. Revoke it and set it again.
• A name is up to 128 ASCII letters, digits and _, and does not start with a digit.
• A value is 1 byte to 8 KiB on one line, with no control characters.
• A new value reaches the service within 30 seconds.
• Values are stored encrypted with AES-256-GCM.
• GET /services/{owner}/{name}/runtime lists the declared secrets that are not set.