sbx secret set
| Description | Create or update a secret |
|---|---|
| Usage | sbx secret set [SERVICE] [flags] |
Description
Create or update a secret for a service or registry.
Available services: anthropic, cursor, droid, github, google, groq, mistral, nebius, openai, openrouter, xai
Service secrets apply globally by default. Use --sandbox to scope a secret to one sandbox. When SERVICE is omitted, an interactive prompt selects it.
Unlike service secrets, registry credentials are host-only by default. Use --registry to store pull credentials for a container registry:
- Default: host-only. Used for template and kit pulls on the host; never injected into a sandbox.
- With --all-sandboxes: used for host pulls and injected by the proxy into every new sandbox's registry login. The credential itself never enters the sandbox.
- With --sandbox: injected into that one sandbox only.
Options
| Option | Default | Description |
|---|---|---|
--all-sandboxes
|
Inject registry credentials into every sandbox (requires --registry) | |
-f, --force
|
Overwrite an existing secret when --token is used | |
--oauth
|
Start OAuth flow and store OAuth tokens (openai/global only) | |
--password-stdin
|
Read registry password or token from stdin (use with --registry) | |
--registry
|
Registry hostname for pull credentials (e.g. ghcr.io) | |
--sandbox
|
Scope the secret to one sandbox instead of its default scope | |
-t, --token
|
Secret value (less secure: visible in shell history) | |
--username
|
Registry username (use with --registry; omit for token-only auth) |
Global options
| Option | Default | Description |
|---|---|---|
-D, --debug
|
Enable debug logging |
Examples
# Store a GitHub token globally (available to all sandboxes)
sbx secret set github
# Store an OpenAI key for a specific sandbox
sbx secret set openai --sandbox my-sandbox
# Non-interactive via stdin (e.g., from a secret manager or env var)
echo "$ANTHROPIC_API_KEY" | sbx secret set anthropic
# Start OpenAI OAuth flow and store global OAuth tokens
sbx secret set openai --oauth
# Registry: host-only (template/kit pulls, not injected into sandboxes)
gh auth token | sbx secret set --registry ghcr.io --password-stdin
# Registry: host pulls + injected into every new sandbox
gh auth token | sbx secret set --all-sandboxes --registry ghcr.io --password-stdin
# Registry: specific sandbox only
gh auth token | sbx secret set --sandbox my-sandbox --registry ghcr.io --password-stdin