Org Secrets Management

Org secrets are credentials shared across your organization's Primitive Functions rather than bound to a single function. Reach for them when two or more functions need the same value (an LLM API key, a shared token) and you want one place to rotate it.

Prerequisites#

You need the CLI installed and an authenticated session before any org-secrets-* command will work.

1. 1

   Install the CLI#

   npm install -g primitive
   

   Or run it without installing:

   npx primitive@latest org-secrets-list
   

2. 2

   Confirm you're authenticated#

   primitive whoami
   

   If this fails, sign in with primitive login or primitive signin, or set PRIMITIVE_API_KEY in your environment. See Authentication: login, signup, logout, whoami.

Discover the exact flags#

Run the command's own help to get the authoritative flag and argument surface, which the CLI generates from the API:

primitive org-secrets-set --help
primitive org-secrets-list --help
primitive org-secrets-remove --help

Per-command help carries enough detail to compose any operation without leaving the terminal, so treat it as the reference for argument order and optional flags.

Set an org secret#

primitive org-secrets-set writes a key-value secret at the organization scope, creating it or overwriting an existing value.

primitive org-secrets-set OPENAI_API_KEY "$OPENAI_API_KEY"

Secret keys follow the same convention as function secrets: uppercase letters, digits, and underscores, with the first character a letter or underscore (^[A-Z_][A-Z0-9_]*$).

List org secrets#

primitive org-secrets-list prints the org secrets currently configured, so you can audit what's set before a deploy or confirm a rotation landed.

primitive org-secrets-list

Remove an org secret#

primitive org-secrets-remove deletes an org secret by key.

primitive org-secrets-remove OPENAI_API_KEY

Next steps#