spice-secrets

Original：🇺🇸 English

Translated

Configure secret stores in Spice (environment variables, Kubernetes, AWS Secrets Manager, keyring). Use when asked to "configure secrets", "add API keys", "set up credentials", "manage passwords", "use environment variables", or "configure .env file".

1installs

Sourcespiceai/skills

Added on2026-02-17

NPX Install

npx skill4agent add spiceai/skills spice-secrets

SKILL.md Content

View Translation Comparison →

Spice Secret Stores

Secret stores manage sensitive data like API keys, passwords, and tokens. The

env

store is loaded by default.

Basic Configuration

yaml

secrets:
  - from: <store_type>
    name: <store_name>

Supported Secret Stores

Store	From Format	Description
Environment	`env`	Environment variables + `.env` / `.env.local` files (default)
Kubernetes	`kubernetes:<secret_name>`	Kubernetes secrets
AWS Secrets Manager	`aws_secrets_manager`	AWS Secrets Manager
Keyring	`keyring`	OS keyring (macOS Keychain, Linux, Windows)

Default: Environment Variables

Loaded automatically. Reads from environment variables and any

.env.local

or

.env

files in the project directory.

yaml

secrets:
  - from: env
    name: env

Referencing Secrets

Use

${ store_name:KEY_NAME }

syntax in component parameters:

yaml

datasets:
  - from: postgres:my_table
    name: my_table
    params:
      pg_user: ${ env:PG_USER }
      pg_pass: ${ env:PG_PASSWORD }

models:
  - from: openai:gpt-4o
    name: gpt4
    params:
      openai_api_key: ${ secrets:OPENAI_API_KEY }

Also works within strings:

yaml

params:
  mysql_connection_string: mysql://${env:USER}:${env:PASSWORD}@localhost:3306/db

Searching All Stores

Use

${ secrets:KEY }

to search all configured stores in precedence order (last defined wins):

yaml

secrets:
  - from: env
    name: env
  - from: keyring
    name: keyring

datasets:
  - from: postgres:my_table
    name: my_table
    params:
      pg_user: ${ secrets:pg_user }     # checks keyring first, then env
      pg_pass: ${ secrets:pg_pass }

The

<key_name>

is automatically uppercased for the

env

secret store.

Examples

Kubernetes Secrets

yaml

secrets:
  - from: kubernetes:my-app-secrets
    name: k8s

AWS Secrets Manager

yaml

secrets:
  - from: aws_secrets_manager
    name: aws
    params:
      aws_region: us-east-1

Override Order (env overrides keyring)

yaml

secrets:
  - from: keyring
    name: keyring
  - from: env
    name: env

spice-secrets

NPX Install

Tags

SKILL.md Content

Spice Secret Stores

Basic Configuration

Supported Secret Stores

Default: Environment Variables

Referencing Secrets

Searching All Stores

Examples

Kubernetes Secrets

AWS Secrets Manager

Override Order (env overrides keyring)

Documentation