Secrets

import { secret } from "@griffin-app/griffin";

builder.request("authenticated-call", {
  method: GET,
  base: "https://api.example.com",
  response_format: Json,
  path: "/protected",
  headers: {
    "Authorization": secret("API_KEY"),
    "X-API-Token": secret("SERVICE_TOKEN"),
  },
})

secret("API_KEY")                              // Simple reference
secret("DB_CREDENTIALS", { field: "password" }) // Extract a field from a JSON secret
secret("API_KEY", { version: "2" })             // Pin to a specific version

# Set a secret (prompts for value)
griffin secrets set API_KEY

# Set with a specific value
griffin secrets set API_KEY --value "sk-1234..." --env production

# List secrets (names only — values are never shown)
griffin secrets list --env production

# View secret metadata
griffin secrets get API_KEY --env production

# Delete a secret
griffin secrets delete API_KEY --env production

# On the hub/executor machine
export API_KEY="sk-1234..."

SECRET_PROVIDER=aws
AWS_SECRETS_PREFIX=griffin/          # Optional prefix for secret names
AWS_SECRETS_ROLE_ARN=arn:aws:iam::123:role/griffin  # Optional cross-account role

SECRET_PROVIDER=vault
VAULT_ADDR=https://vault.example.com
VAULT_TOKEN=hvs.your-token