SecretService

SecretService manages project-scoped secrets: named values stored encrypted, attached to sandboxes by name at creation. The sandbox only ever receives an opaque per-sandbox placeholder as an environment variable — the platform's egress proxy substitutes the real value into outbound requests, so the real value never enters the sandbox and is never returned by the API (values are write-only). Obtain the service as daytona.secret. See the secrets guide.

set()

Creates a secret, or updates an existing one's value and metadata (upsert by name).

set(name: string, value: string, options: SetSecretOptions = {}): Promise<void>

await daytona.secret.set('OPENAI_API_KEY', 'sk-...', {
  allowedDomains: ['api.openai.com'],
  description: 'OpenAI key for eval runs',
})

get()

Fetches one secret's metadata — name, allowed domains, description, last-update time. Never the value.

get(name: string): Promise<Secret>

Returns: Secret — { name, allowed_domains, description, updated_at }. Throws: DaytonaNotFoundError if the secret does not exist.

list()

Lists secret metadata for the project. Never returns values.

list(): Promise<Secret[]>

delete()

Deletes a secret. Idempotent, and already-running sandboxes that attached it are unaffected.

delete(name: string): Promise<void>

Attaching secrets to a sandbox

Pass secret names in secrets at creation. Each becomes an environment variable inside the sandbox whose value is an opaque placeholder; outbound requests to permitted hosts have the placeholder replaced with the real value in transit.

await daytona.secret.set('OPENAI_API_KEY', 'sk-...', { allowedDomains: ['api.openai.com'] })
 
const sandbox = await daytona.create({
  image: 'node:22-slim',
  secrets: ['OPENAI_API_KEY'],
})
// Inside the sandbox, $OPENAI_API_KEY holds an opaque placeholder;
// outbound requests to api.openai.com carry the real key.

See environment and secrets for placeholder semantics and naming rules.