Agentic Data Plane

rpk ai secret

Manage the secrets that LLM providers, MCP servers, OAuth clients, and agents reference by ID, for example with --openai-config.api-key-ref. Secret values are write-only: no command prints a stored value.

Pass the value with --value-file (use - for stdin) rather than --value, which leaves it in your shell history.

Commands take either the bare ID, such as OPENAI_API_KEY, or the resource name, such as secrets/OPENAI_API_KEY.

This command was introduced in ai version 0.2.92.

Usage

rpk ai secret [flags]

Subcommands

Command Description

rpk ai secret create

Create a secret. Resources reference the secret by its ID, for example --openai-config.api-key-ref <id>.

rpk ai secret delete

Delete a secret. The store does not check references: resources that still name this secret (LLM providers, MCP servers, OAuth clients, agents) fail at runtime once it is gone.

rpk ai secret get

Get a secret’s metadata (tags and audit fields; never the value).

rpk ai secret list

List secrets. --filter and --tag are ANDed into one AIP-160 filter; --name-contains then narrows the result to ids containing the substring.

rpk ai secret update

Update a secret. Only the values you pass change.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.