---
title: "Org Secrets Management"
canonical: "https://test.abhinandan.one/cli-overview/cli-org-secrets"
markdown_url: "https://test.abhinandan.one/cli-overview/cli-org-secrets.md"
publisher: "Primitive SDKs"
kind: "guide"
content_type: "reference"
category: "CLI"
parent: "cli-overview"
description: "Set, list, and remove org-wide secrets shared across all Primitive Functions using primitive org-secrets-set, org-secrets-list, and org-secrets-remove."
keywords: ["primitive org-secrets-list", "primitive org-secrets-set", "primitive org-secrets-remove", "org secrets", "Primitive Functions secrets", "PRIMITIVE_API_KEY"]
last_modified: "2026-08-21T18:22:43.359885+00:00"
published_at: "2026-08-11T18:54:54.317204+00:00"
sections:
  - {anchor: "prerequisites", title: "Prerequisites"}
  - {anchor: "step-install-the-cli", title: "Install the CLI"}
  - {anchor: "step-confirm-youre-authenticated", title: "Confirm you're authenticated"}
  - {anchor: "discover-the-exact-flags", title: "Discover the exact flags"}
  - {anchor: "set-an-org-secret", title: "Set an org secret"}
  - {anchor: "list-org-secrets", title: "List org secrets"}
  - {anchor: "remove-an-org-secret", title: "Remove an org secret"}
  - {anchor: "next-steps", title: "Next steps"}
---

> Documentation index: https://test.abhinandan.one/llms.txt

# Org Secrets Management

Manage organization-wide secrets shared across every Primitive Function from the terminal, without redeclaring the same credential on each deploy.

Org secrets are credentials shared across your organization's [Primitive Functions](https://test.abhinandan.one/cli-overview/cli-functions.md) rather than bound to a single function. Reach for them when two or more functions need the same value (an LLM API key, a shared token) and you want one place to rotate it.

> **Note:** This page covers the `primitive org-secrets-*` command group. Per-function secrets, deploy flags, and routing live in [Primitive Functions: Deploy, Route, and Manage](https://test.abhinandan.one/cli-overview/cli-functions.md).

## Prerequisites

You need the CLI installed and an authenticated session before any `org-secrets-*` command will work.

### 1. Install the CLI

```bash
npm install -g primitive
```

Or run it without installing:

```bash
npx primitive@latest org-secrets-list
```

### 2. Confirm you're authenticated

```bash
primitive whoami
```

If this fails, sign in with `primitive login` or `primitive signin`, or set `PRIMITIVE_API_KEY` in your environment. See [Authentication: login, signup, logout, whoami](https://test.abhinandan.one/cli-overview/cli-authentication.md).

## Discover the exact flags

Run the command's own help to get the authoritative flag and argument surface, which the CLI generates from the API:

```bash
primitive org-secrets-set --help
primitive org-secrets-list --help
primitive org-secrets-remove --help
```

Per-command help carries enough detail to compose any operation without leaving the terminal, so treat it as the reference for argument order and optional flags.

## Set an org secret

`primitive org-secrets-set` writes a key-value secret at the organization scope, creating it or overwriting an existing value.

```bash
primitive org-secrets-set OPENAI_API_KEY "$OPENAI_API_KEY"
```

Secret keys follow the same convention as function secrets: uppercase letters, digits, and underscores, with the first character a letter or underscore (`^[A-Z_][A-Z0-9_]*$`).

> **Tip:** Read the value from your own environment rather than typing it inline, so the secret never lands in shell history or the process list. The CLI uses the same pattern for wallet keys with `PRIMITIVE_X402_PRIVATE_KEY`.

## List org secrets

`primitive org-secrets-list` prints the org secrets currently configured, so you can audit what's set before a deploy or confirm a rotation landed.

```bash
primitive org-secrets-list
```

## Remove an org secret

`primitive org-secrets-remove` deletes an org secret by key.

```bash
primitive org-secrets-remove OPENAI_API_KEY
```

> **Warning:** Removal affects every function that reads the key. Re-run `primitive org-secrets-list` afterwards to confirm, and redeploy or re-check any function that depended on it.