> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing secrets

> Store, grant, rotate, and revoke proof-bound sandbox credentials.

hiloop can store organization-scoped sandbox secrets as write-only, envelope-encrypted control-plane data.
You can register, rotate, revoke, and list metadata without reading a value back.

```sh theme={null}
printf '%s' "$OPENAI_KEY" | hiloop secret set openai-prod --dest-host api.openai.com --value-stdin
hiloop secret list
printf '%s' "$NEW_KEY" | hiloop secret rotate openai-prod --value-stdin
hiloop secret revoke openai-prod
```

Reading from standard input keeps the value out of command arguments and shell history. The CLI
accepts one line of at most 4096 bytes. Brokered v1 accepts a bearer token bound to one exact public
HTTPS hostname and always injects it as `Authorization: Bearer …` outside the sandbox Pod.

Creating a secret grants its creator use by default. Owners and admins can inspect or change exact
principal grants without reading the value. A secret accepts at most 200 grants, including its
creator grant:

```sh theme={null}
hiloop secret grants openai-prod
hiloop secret grant openai-prod --to service-account/00000000-0000-0000-0000-000000000001
hiloop secret ungrant openai-prod --from service-account/00000000-0000-0000-0000-000000000001
```

## Delivery is deployment-gated and fail-closed

The control plane admits a non-empty secret binding only when the deployment configures the complete
mutual-TLS release boundary. The hosted service enables this boundary for bearer secrets bound to one
exact public HTTPS hostname. Localhost, private destinations, IP literals, and IPv6 destinations are
not supported. A request fails closed if the full release and capture path is unavailable.

Do not work around this by placing a provider key in an environment variable, image layer, command
line, workspace, or Kubernetes Secret mounted into the workload. Those paths expose plaintext to the
agent and to process-inspection or logging surfaces.

Every request rechecks live sandbox identity, exact destination, binding, principal
grant, revocation, and current version before the API releases plaintext to the trusted external
Envoy. The API commits a content-free decision record first. Plaintext is never delivered into the
sandbox environment, argv, `/proc`, or workspace, or written to logs or telemetry. The authorized
origin remains part of the trust boundary and may reflect the credential.

See the [security model](/deployment/security-model) and
[egress and secrets API contract](/sandboxes/egress-secrets).