name: sbx secret
synopsis: Manage stored secrets
description: |-
    Manage stored secrets for sandbox environments.

    SERVICE SECRETS (e.g. "github", "anthropic", "openai")
      When a sandbox starts, the proxy uses stored secrets to authenticate API
      requests on behalf of the agent. The secret is never exposed directly.
      Scoped globally (shared across all sandboxes) or to a specific sandbox.

    REGISTRY SECRETS (e.g. "ghcr.io", "myregistry.azurecr.io")
      Used to pull private template images and kit artifacts before sandbox
      creation. Host-only secrets (no -g) are not injected into sandboxes;
      global secrets (-g) are written as ~/.docker/config.json in every new sandbox.
      Use "sbx secret set --registry <host> --password-stdin" to store them.
options:
    - name: help
      shorthand: h
      default_value: "false"
      usage: help for secret
inherited_options:
    - name: debug
      shorthand: D
      default_value: "false"
      usage: Enable debug logging
see_also:
    - sbx - Manage AI coding agent sandboxes.
    - sbx secret ls - List stored secrets
    - sbx secret rm - Remove a secret
    - sbx secret set - Create or update a secret
    - sbx secret set-custom - (Experimental) Create or update a custom secret
