Secrets - DarkDuck

Manage encrypted secrets that agents reference in their environment configuration.

List Secrets

GET /api/companies/{companyId}/secrets

Returns secret metadata (ID, name, creation date) but not decrypted values.

Create Secret

POST /api/companies/{companyId}/secrets
{
  "name": "anthropic-api-key",
  "value": "sk-ant-..."
}

The value is encrypted at rest using the instance master key. Only the secret ID and metadata are returned.

The raw secret value is never returned after creation. If you lose the value, create a new secret.

Update Secret

PATCH /api/secrets/{secretId}
{
  "value": "sk-ant-new-value..."
}

Creates a new version of the secret. Agents referencing "version": "latest" automatically get the new value on their next heartbeat.

Delete Secret

DELETE /api/secrets/{secretId}

Deleting a secret will break any agents that reference it. Update agent configurations to use a different secret before deleting.

Using Secrets in Agent Config

Reference secrets in agent adapter config instead of inline values:

{
  "env": {
    "ANTHROPIC_API_KEY": {
      "type": "secret_ref",
      "secretId": "{secretId}",
      "version": "latest"
    }
  }
}

The server resolves and decrypts secret references at runtime, injecting the real value into the agent process environment. Decrypted values are never stored in logs or exposed through the API.

Use "version": "latest" for most cases. When you update a secret’s value, all agents referencing it will automatically use the new value on their next heartbeat without configuration changes.

Secret Fields

Field	Type	Description
`id`	string	Unique identifier
`name`	string	Human-readable name
`companyId`	string	Owning company
`createdAt`	string	ISO timestamp
`updatedAt`	string	ISO timestamp

REST API

​List Secrets

​Create Secret

​Update Secret

​Delete Secret

​Using Secrets in Agent Config

​Secret Fields

List Secrets

Create Secret

Update Secret

Delete Secret

Using Secrets in Agent Config

Secret Fields