Secrets

Secrets are project-scoped, encrypted-at-rest values attached to sandboxes by name. Values are write-only: no endpoint ever returns a stored value — reads return metadata only. Inside a sandbox a secret is represented by a placeholder; the real value is substituted on outbound requests to allowed destinations. See the Secrets guide.

PUT /secrets/:name

Create or update a secret. Returns 204 No Content. The name doubles as the injected environment variable name, so it must match [A-Za-z_][A-Za-z0-9_]* (max 256 chars).

Request

Field	Type	Required / default	Description
`value`	string	required	The secret value, ≤ 64 KiB. Write-only.
`allowed_domains`	array of strings	`[]`	Destinations the real value may be sent to: exact hostnames or `*.wildcard` entries. No schemes, paths, or ports.
`description`	string	none	Free-form note.

cURL

curl -X PUT https://api.rl.trydaytona.com/secrets/OPENAI_API_KEY \
  -H "Authorization: Bearer $RLP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "sk-proj-xxxxxxxxxxxx",
    "allowed_domains": ["api.openai.com"],
    "description": "LLM access for workers"
  }'

Response: 204 No Content.

Errors

400 — invalid name (must be [A-Za-z_][A-Za-z0-9_]*), value > 64 KiB, or an invalid allowed_domains entry.
503 — secret encryption temporarily unavailable; retry.

GET /secrets

List the project's secrets — metadata only, never values. Secrets that serve as object-store credentials are hidden by default.

Query param	Type	Default	Description
`include_object_store`	bool	`false`	Also return object-store credential secrets; each item carries an `object_store` flag.

cURL

curl https://api.rl.trydaytona.com/secrets \
  -H "Authorization: Bearer $RLP_API_KEY"

{
  "secrets": [
    {
      "name": "OPENAI_API_KEY",
      "allowed_domains": ["api.openai.com"],
      "description": "LLM access for workers",
      "updated_at": "2026-07-31T10:15:00Z",
      "object_store": false
    }
  ]
}

GET /secrets/:name

Metadata for one secret — never the value.

cURL

curl https://api.rl.trydaytona.com/secrets/OPENAI_API_KEY \
  -H "Authorization: Bearer $RLP_API_KEY"

{
  "name": "OPENAI_API_KEY",
  "allowed_domains": ["api.openai.com"],
  "description": "LLM access for workers",
  "updated_at": "2026-07-31T10:15:00Z"
}

Errors

404 — no secret with this name.

DELETE /secrets/:name

Delete a secret. Idempotent — returns 204 No Content even if the name doesn't exist. Running sandboxes that already attached the secret keep working until they are torn down.

cURL

curl -X DELETE https://api.rl.trydaytona.com/secrets/OPENAI_API_KEY \
  -H "Authorization: Bearer $RLP_API_KEY"

Response: 204 No Content.

Usage

Attach secrets on POST /vms with the secrets array:

{
  "image": "node:20",
  "secrets": ["OPENAI_API_KEY"]
}

Every listed name must exist in the project — an unknown name fails the create with 400, before anything is provisioned.
Real values never enter the sandbox: the environment variable holds a per-sandbox placeholder (rlps_...), and the value is substituted only on outbound traffic to the secret's allowed_domains.
Contrast with the env field, which carries its values into the sandbox verbatim. See Environment & Secrets.

On this page