Store a provider credential safely

printf %s "$API_KEY" | tovio config secret set openai-production --from-stdintovio config secret status openai-production

Seals a credential — typically an AI provider key used by a resolver or agent plugin — under a non-secret reference name. That reference is what your configuration stores in ai.credential; the secret itself never appears there.

--from-stdin is required, not optional

It is an explicit acknowledgement that the value arrives on standard input, and there is deliberately no --value flag. A secret on a command line lands in shell history, the process table, and any log capturing commands. Requiring a pipe removes that failure mode rather than warning about it.

Replacing one

printf %s "$NEW_KEY" | tovio config secret set openai-production --from-stdin --force

Setting an existing reference without --force is refused, so you cannot overwrite a working credential by accident.

Status never reveals it

tovio config secret status openai-production

Reports whether the credential is present. It does not print it, and there is no command that does. If you need the value, get it from the provider again.

Where it goes

Into the platform keystore alongside your identity key — sealed at rest under this machine's wrapping key, never in the object store, never synced. It is local to this machine, so each machine seals its own.

Using it

Plugins and agent integrations reference it by name. They receive the capability to use it, not the bytes to copy.

This is not for repository secrets

A config secret is a local credential for TOVIO itself. A secret that belongs in your repository belongs behind a policy, encrypted at snapshot. Putting a deployment credential here does not get it to your teammates.