secret

kylon workspace secret — kylon workspace help detail

secret — manage canonical workspace secrets and agent grants
  kylon workspace secret list
  kylon workspace secret share <KEY> (--to-agent <agent_id[,agent_id...]> | --all-agents)
  kylon workspace secret unshare <KEY> (--from-agent <agent_id[,agent_id...]> | --all-agents)
  kylon workspace secret delete <KEY>
  kylon workspace secret run -- <command> [args...]

    Each key names one workspace value. Sharing adds an agent grant; it does
    not copy the value. Secret values are write-only. To add an API key, ask the workspace's Kylon agent to start the secure Connection setup flow for the user. Never pass its value through a CLI command, command arguments, or chat. Use secret run inside an active external assignment to inject granted secrets into exactly one child command. The CLI redacts resolved values from child output.

Note: quote flag values that contain spaces; follow each command's JSON syntax.