Secrets | NVIDIA Brev Documentation

Secrets let your organization store reusable sensitive values, such as API keys and access tokens, without hard-coding them in a Launchable definition, setup script, or parameter default. Each secret belongs to one organization and keeps an immutable history of its values.

Brev Secrets provide values to Launchables at startup. They do not create persistent, VM-wide environment variables, continuously update running workloads, or replace a runtime secret manager.

If Secrets in organization settings or Use a secret in a Launchable does not appear, the feature has not been enabled for your account.

Manage these secrets in the Brev Console. They are distinct from the legacy brev secret variables and files workflow and from credentials used to authenticate to Brev.

Access and Permissions

Access comes from either an organization role or a direct grant on a secret.

Access	Permissions
Organization Owner, Admin, or Maintainer	Create and fully manage every secret in the organization.
Organization Member	Create secrets and view secret metadata. Revealing or using another secret requires direct Reader or Maintainer access. A member who creates a secret becomes its Maintainer.
Secret Reader	Reveal, copy, and use the secret’s values.
Secret Maintainer	Reader permissions, plus create versions, manage direct access, and delete the secret.

The access picker allows grants only to current members of the secret’s organization.

Removing someone from the organization does not automatically remove an existing direct secret grant. Remove the user’s direct access from each secret separately.

Create a Secret

Open Secrets

In the Brev Console, select the organization, open its settings, and select Secrets.

Enter the Secret

Select Create secret, then enter:

Name: A name that is unique within the organization, such as NGC_API_KEY.
Secret value: A non-empty value up to 4 KiB.

Create Version 1

Select Create secret. Brev encrypts the value and creates version 1. The value is hidden in the secrets list, and you become a Maintainer of the secret.

Secret names cannot be changed. To use another name, create a new secret and update any deployment workflow that uses the old one.

Reveal and Version a Secret

Open a secret and use Reveal to display a value. You can copy the value or select Hide when you no longer need it displayed.

Reveal a value only in a trusted session. Revealing displays plaintext in the Console, and copying places the plaintext on your clipboard.

To rotate a value, select New version and enter the replacement. Brev increments the version number and retains every earlier version under Version history.

Versions are immutable and cannot be deleted individually. Anyone who can reveal the secret can reveal any retained version.

Manage Direct Access

Secret Maintainers and organization Owners, Admins, and Maintainers can grant direct access:

Open the secret and select Grant access.
Select an organization member.
Assign Reader or Maintainer access.

Use Modify to change a direct access level or Remove to revoke direct access.

Use a Secret with a Launchable

A Launchable creator first defines a Text launch parameter for the value that the workload expects. The parameter name controls the environment variable name; the secret name does not need to match it.

Open the Launchable

Open the Launchable’s deployment page and sign in to the Brev Console.

Choose Use a secret

Find the Text parameter under Setup values and select Use a secret.

Select a Secret and Version

Select a secret that you can access in the active organization. Brev initially selects the version marked Latest; you can choose an earlier version instead.

Deploy

Complete the compute configuration and deploy the Launchable. Brev resolves the exact selected version and supplies its value to the parameter’s startup path.

Choice parameters do not support saved secrets. Enter or select one of their allowed values instead.

Each deployment uses the exact version selected when the deployment is submitted. Creating a newer version does not update a deployment that is already staged or running. Select the new version the next time you deploy.

Runtime Handling and Security

Selecting a saved secret changes where a Launchable parameter value comes from, not how the workload receives it. The runtime mode and value-lifetime behavior is the same as for a manually entered Setup value.

Brev stores saved secret versions encrypted at rest. During deployment, Brev resolves the selected version and uses a short-lived encrypted handoff to the startup process. The workload receives plaintext and can persist or expose it.

Follow these practices:

Do not print secret values or enable shell tracing with set -x; setup output is captured in logs.
Do not put secret values in image names, labels, commands, notebooks, source code, or parameter defaults.
Treat users with root access, Docker access, or access to the receiving process as able to inspect runtime values.
Use credentials with minimum permissions and rotate them regularly.
Use a runtime secret manager when an application must retrieve a value continuously or after restarts.

Removing access, creating a new version, or deleting the saved secret does not remove a value already delivered to a workload.

Delete a Secret

Open the secret, select Delete, and enter the secret name to confirm. Deleting a secret permanently deletes all of its saved versions and cannot be undone.

Deletion does not remove copies already delivered to a workload. Update affected deployment workflows before deleting a secret.

Troubleshooting

Problem	Resolution
Secrets or Use a secret is not available	The feature may not be enabled for your account. If Secrets is available but Use a secret is not, confirm that the parameter is Text; Choice parameters do not support saved secrets.
A secret is missing from the picker	Confirm that the correct organization is active and that you have direct Reader or Maintainer access, or are an organization Owner, Admin, or Maintainer.
You can see a secret but cannot reveal it	Organization Members can view metadata without value access. Ask someone with management access to grant Reader or Maintainer access.
You cannot create a version or manage access	Reader access does not include management. Ask a Secret Maintainer or an organization Owner, Admin, or Maintainer.
A new version is not used automatically	On the next deployment, select the new version under Setup values. Deployments use an exact version.
A value is missing after startup	Review the runtime mode behavior. Some modes expose parameters only during their startup script.

What’s Next

Launchables

Define launch parameters and understand where values are available at runtime.

Deploying NVIDIA NIMs

Use an NGC API key to run NVIDIA Inference Microservices.