name: sbx secret set
synopsis: Create or update a secret
description: |-
    Create or update a secret for a service or registry.

    Available services: anthropic, aws, cursor, droid, github, google, groq, mistral, nebius, openai, openrouter, xai

    When no arguments are provided, an interactive prompt guides you through
    scope and service selection.

    Use --registry to store pull credentials for a container registry:
      Without -g: host-only — used for template/kit pulls, not injected into sandboxes.
      With -g:    global   — host pulls AND written as ~/.docker/config.json in every new sandbox.
      With SANDBOX as the first argument: scoped to that specific sandbox only.
usage: sbx secret set [-g | SANDBOX] [SERVICE] [flags]
options:
    - name: force
      shorthand: f
      default_value: "false"
      usage: Overwrite an existing secret when --token is used
    - name: global
      shorthand: g
      default_value: "false"
      usage: Use global secret scope
    - name: help
      shorthand: h
      default_value: "false"
      usage: help for set
    - name: oauth
      default_value: "false"
      usage: Start OAuth flow and store OAuth tokens (openai/global only)
    - name: password-stdin
      default_value: "false"
      usage: |
        Read registry password or token from stdin (use with --registry)
    - name: registry
      usage: Registry hostname for pull credentials (e.g. ghcr.io)
    - name: token
      shorthand: t
      usage: 'Secret value (less secure: visible in shell history)'
    - name: username
      usage: |
        Registry username (use with --registry; omit for token-only auth)
inherited_options:
    - name: debug
      shorthand: D
      default_value: "false"
      usage: Enable debug logging
example: |4-
      # Store a GitHub token globally (available to all sandboxes)
      sbx secret set -g github

      # Store an OpenAI key for a specific sandbox
      sbx secret set my-sandbox openai

      # Non-interactive via stdin (e.g., from a secret manager or env var)
      echo "$ANTHROPIC_API_KEY" | sbx secret set -g anthropic

      # Start OpenAI OAuth flow and store global OAuth tokens
      sbx secret set -g openai --oauth

      # Registry: host-only (template/kit pulls, not injected into sandboxes)
      gh auth token | sbx secret set --registry ghcr.io --password-stdin

      # Registry: global (host pulls + injected into every new sandbox)
      gh auth token | sbx secret set -g --registry ghcr.io --password-stdin

      # Registry: specific sandbox only
      gh auth token | sbx secret set my-sandbox --registry ghcr.io --password-stdin
see_also:
    - sbx secret - Manage stored secrets
