Skip to main content

Manage Secrets and Credentials

Verdictan has two supported command groups for credentials used by gateway configuration.

verdictan secret: manage hosted secret records​

Use verdictan secret to store a Verdictan secret record. A connected gateway can reference the record by name through secret_key_ref.store.

Secret record commands​

verdictan secret list
verdictan secret get --secret-id 00000000-0000-4000-a000-000000000101
verdictan secret create --name VERDICTAN_OPENAI_API_KEY --env-var VERDICTAN_OPENAI_API_KEY
printf 'updated-secret' | verdictan secret update --secret-id 00000000-0000-4000-a000-000000000101 --stdin --json
verdictan secret delete --secret-id 00000000-0000-4000-a000-000000000101 --yes

Input sources​

verdictan secret create and verdictan secret update read secret material from one of these supported sources:

  • --env-var <VAR_NAME>
  • --keychain <service:account>
  • --stdin

create must use one value source. update can change only the description, or it can replace the value from one source. The keychain source reads a macOS service:account entry. Hosted secret commands must use API authentication. get returns only metadata. It does not return raw secret material.

verdictan secrets: resolve local provider credentials​

Use verdictan secrets to prepare a local runtime. The command loads or examines credentials from your workstation.

Add a local provider credential​

verdictan secrets add VERDICTAN_OPENAI_API_KEY --keychain

The command prompts without echo and stores the value in the macOS Keychain. Keychain storage is the only backend. This command returns an unsupported error on other operating systems. When stdin is not a terminal, the command reads one line from the pipe.

Examine resolution status for a config​

verdictan secrets status --config policy-config.yaml

Output shows which provider targets can use a local environment or keychain credential. Store-backed references have an unknown status because this local command does not call the API. The table shows missing credentials. These credentials do not make the command exit nonzero.

Non-secret settings​

Non-secret settings belong in the declarative config section that owns them. Use verdictan secret only for values that must continue to be secret.

Validate the resolved config surface​

When credentials are available, validate the resolved runtime view:

verdictan gateway check --config policy-config.yaml --verbose

Use this to parse the config and print provider readiness. If a necessary credential is missing, the command reports Status: Not Ready. The command returns a nonzero exit status. Automation can use the exit status as the readiness result. Keep the output so that you can identify the missing credential.

Select a command​

TaskCommand
Store a hosted secret recordverdictan secret
Add a local workstation credentialverdictan secrets add
Examine local credential resolution for a configverdictan secrets status
Set a non-secret runtime optionEdit the owning field in policy-config.yaml
Validate the resolved gateway configverdictan gateway check

Next steps​