Dockerfile. You declare their names in agentos.yaml, an environment admin enters the values in the panel, and your code receives them on each invocation in context.secrets.
1
Declare the names
agentos.yaml
[A-Z][A-Z0-9_]* and are at most 128 characters.2
Set the values
An environment admin opens the agent’s Secrets tab and enters each value. A value is never shown again after it is saved. Members of the environment see the names, never the values.If you deploy a version that declares a name without a value, the deploy warns you: in its log, with a MISSING SECRETS badge on the Deploy and Secrets tabs, and in
warnings on the deploy (GET /v0/deploys/{id}).3
Read them in your code
context.secrets holds the names this version declares that have a value.How values are handled
- Values are stored encrypted, decrypted only to build the invoke request, and never written to events, logs or webhooks.
- Secrets are not part of a version. A new value applies from the next invocation on, the resume of a held run included; no redeploy needed.
- The build never gets secrets. Fetch what needs credentials at run time, not in your
Dockerfile.
Masking
If your agent echoes a secret of 8 or more characters into its output, its error message, an event or an ask (intent, details, item titles and data), AgentOS stores it as***.
This is a safety net, not a guarantee: an encoded or split value isn’t recognised, and a value rotated in the middle of an invocation may stay unmasked in that invocation’s later events.