Skip to main content
Agent secrets are encrypted environment variables scoped to a specific agent instance. They work the same way as app secrets but are resolved by agent instance name rather than app name.

​
Set a secret

zwrm agent secrets set <NAME>=<VALUE>
zwrm agent secrets set <NAME> <VALUE>
FlagTypeDefaultDescription
--instancestringdefaultAgent instance name

​
Examples

zwrm agent secrets set DATABASE_URL=postgres://user:pass@host/db
zwrm agent secrets set API_KEY "sk-1234567890"
zwrm agent secrets set GITHUB_TOKEN "ghp_abc123" --instance my-project

​
List secrets

zwrm agent secrets list
Shows secret names, versions, status (staged or deployed), and last updated time. Secret values are never displayed.
FlagTypeDefaultDescription
--instancestringdefaultAgent instance name
Alias: zwrm agent secrets ls

​
Remove a secret

zwrm agent secrets unset <NAME>
FlagTypeDefaultDescription
--instancestringdefaultAgent instance name

​
Example

zwrm agent secrets unset GITHUB_TOKEN --instance my-project

​
Import from a file

Bulk import secrets from a .env file: 
zwrm agent secrets add --from-file <path>
FlagTypeDefaultDescription
--from-filestring—Path to .env file (required)
--instancestringdefaultAgent instance name
The file should contain KEY=value pairs, one per line. Lines starting with # are treated as comments and ignored. Quoted values (single or double) are supported.

​
Example

zwrm agent secrets add --from-file .env.production --instance my-project