{"schema_version":"1.0","publisher":"Primitive SDKs","canonical_url":"https://test.abhinandan.one/cli-overview/cli-org-secrets","markdown_url":"https://test.abhinandan.one/cli-overview/cli-org-secrets.md","article":{"id":"95719acf-f45a-468c-8752-ff6e04b83883","article_slug":"cli-org-secrets","parent_article_slug":"cli-overview","parent_article_title":"What is the Primitive CLI?","kind":"guide","published_at":"2026-08-11T18:54:54.317204+00:00","keywords":["primitive org-secrets-list","primitive org-secrets-set","primitive org-secrets-remove","org secrets","Primitive Functions secrets","PRIMITIVE_API_KEY"],"meta_description":"Set, list, and remove org-wide secrets shared across all Primitive Functions using primitive org-secrets-set, org-secrets-list, and org-secrets-remove.","og_image_url":null,"source_file_paths":[],"recording_id":null,"replayable":false,"task_name":"Org Secrets Management","category":"CLI","summary":null,"description":"Manage organization-wide secrets shared across every Primitive Function from the terminal, without redeclaring the same credential on each deploy.","content_kind":"repo_page","content_markdown":"Org secrets are credentials shared across your organization's [Primitive Functions](cli-functions) rather than bound to a single function. Reach for them when two or more functions need the same value (an LLM API key, a shared token) and you want one place to rotate it.\n\n<Note>\n\nThis page covers the `primitive org-secrets-*` command group. Per-function secrets, deploy flags, and routing live in [Primitive Functions: Deploy, Route, and Manage](cli-functions).\n\n</Note>\n\n## Prerequisites\n\nYou need the CLI installed and an authenticated session before any `org-secrets-*` command will work.\n\n<Steps>\n\n<Step title=\"Install the CLI\">\n\n```bash\nnpm install -g primitive\n```\n\nOr run it without installing:\n\n```bash\nnpx primitive@latest org-secrets-list\n```\n\n</Step>\n\n<Step title=\"Confirm you're authenticated\">\n\n```bash\nprimitive whoami\n```\n\nIf this fails, sign in with `primitive login` or `primitive signin`, or set `PRIMITIVE_API_KEY` in your environment. See [Authentication: login, signup, logout, whoami](cli-authentication).\n\n</Step>\n\n</Steps>\n\n## Discover the exact flags\n\nRun the command's own help to get the authoritative flag and argument surface, which the CLI generates from the API:\n\n```bash\nprimitive org-secrets-set --help\nprimitive org-secrets-list --help\nprimitive org-secrets-remove --help\n```\n\nPer-command help carries enough detail to compose any operation without leaving the terminal, so treat it as the reference for argument order and optional flags.\n\n## Set an org secret\n\n`primitive org-secrets-set` writes a key-value secret at the organization scope, creating it or overwriting an existing value.\n\n```bash\nprimitive org-secrets-set OPENAI_API_KEY \"$OPENAI_API_KEY\"\n```\n\nSecret keys follow the same convention as function secrets: uppercase letters, digits, and underscores, with the first character a letter or underscore (`^[A-Z_][A-Z0-9_]*$`).\n\n<Tip>\n\nRead the value from your own environment rather than typing it inline, so the secret never lands in shell history or the process list. The CLI uses the same pattern for wallet keys with `PRIMITIVE_X402_PRIVATE_KEY`.\n\n</Tip>\n\n## List org secrets\n\n`primitive org-secrets-list` prints the org secrets currently configured, so you can audit what's set before a deploy or confirm a rotation landed.\n\n```bash\nprimitive org-secrets-list\n```\n\n## Remove an org secret\n\n`primitive org-secrets-remove` deletes an org secret by key.\n\n```bash\nprimitive org-secrets-remove OPENAI_API_KEY\n```\n\n<Warning>\n\nRemoval affects every function that reads the key. Re-run `primitive org-secrets-list` afterwards to confirm, and redeploy or re-check any function that depended on it.\n\n</Warning>\n\n## Next steps\n\n<CardGroup cols={2}>\n\n<Card title=\"Primitive Functions: Deploy, Route, and Manage\" href=\"cli-functions\">\n\nDeploy functions and manage per-function secrets alongside shared org secrets.\n\n</Card>\n\n<Card title=\"What is the Primitive CLI?\" href=\"cli-overview\">\n\nSee how the org-secrets command group fits into the CLI's full command surface.\n\n</Card>\n\n<Card title=\"Primitive Functions and Recipient Routing (Platform Concepts)\" href=\"functions-and-routing-concepts\">\n\nUnderstand how functions consume secrets and routes at runtime.\n\n</Card>\n\n<Card title=\"Authentication: login, signup, logout, whoami\" href=\"cli-authentication\">\n\nSet up the CLI credentials required before managing org secrets.\n\n</Card>\n\n</CardGroup>","canonical_base_url":"https://test.abhinandan.one","seo_indexing_enabled":true,"last_modified":"2026-08-21T18:22:43.359885+00:00","video_url":null,"voiceover_url":null,"tools_used":[],"demonstrated_by":[],"steps":[],"related_links":[],"intro":null,"prerequisites":[],"verification":[],"troubleshooting":[],"suggest_edit_url":null,"raise_issue_url":"https://github.com/abhi-browzer/primitive-sdks/issues/new?title=Docs+feedback%3A+Org+Secrets+Management&body=Page%3A+https%3A%2F%2Ftest.abhinandan.one%2Fcli-org-secrets","page_feedback_enabled":true,"verified_ref":null,"verified_at":"2026-08-11T18:38:45.205849+00:00"}}