> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/brev/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/brev/_mcp/server. # Secrets > Store encrypted, versioned organization secrets and use them as NVIDIA Brev Launchable parameter values. Secrets let your organization store reusable sensitive values, such as API keys and access tokens, without hard-coding them in a Launchable definition, setup script, or parameter default. Each secret belongs to one organization and keeps an immutable history of its values. Brev Secrets provide values to Launchables at startup. They do not create persistent, VM-wide environment variables, continuously update running workloads, or replace a runtime secret manager. If **Secrets** in organization settings or **Use a secret** in a Launchable does not appear, the feature has not been enabled for your account. Manage these secrets in the Brev Console. They are distinct from the legacy `brev secret` variables and files workflow and from credentials used to authenticate to Brev. ## Access and Permissions Access comes from either an organization role or a direct grant on a secret. | Access | Permissions | | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Organization Owner, Admin, or Maintainer** | Create and fully manage every secret in the organization. | | **Organization Member** | Create secrets and view secret metadata. Revealing or using another secret requires direct Reader or Maintainer access. A member who creates a secret becomes its Maintainer. | | **Secret Reader** | Reveal, copy, and use the secret's values. | | **Secret Maintainer** | Reader permissions, plus create versions, manage direct access, and delete the secret. | The access picker allows grants only to current members of the secret's organization. Removing someone from the organization does not automatically remove an existing direct secret grant. Remove the user's direct access from each secret separately. ## Create a Secret #### Open Secrets In the [Brev Console](https://brev.nvidia.com), select the organization, open its settings, and select **Secrets**. #### Enter the Secret Select **Create secret**, then enter: * **Name**: A name that is unique within the organization, such as `NGC_API_KEY`. * **Secret value**: A non-empty value up to 4 KiB. #### Create Version 1 Select **Create secret**. Brev encrypts the value and creates version 1. The value is hidden in the secrets list, and you become a Maintainer of the secret. Secret names cannot be changed. To use another name, create a new secret and update any deployment workflow that uses the old one. ## Reveal and Version a Secret Open a secret and use **Reveal** to display a value. You can copy the value or select **Hide** when you no longer need it displayed. Reveal a value only in a trusted session. Revealing displays plaintext in the Console, and copying places the plaintext on your clipboard. To rotate a value, select **New version** and enter the replacement. Brev increments the version number and retains every earlier version under **Version history**. Versions are immutable and cannot be deleted individually. Anyone who can reveal the secret can reveal any retained version. ## Manage Direct Access Secret Maintainers and organization Owners, Admins, and Maintainers can grant direct access: 1. Open the secret and select **Grant access**. 2. Select an organization member. 3. Assign **Reader** or **Maintainer** access. Use **Modify** to change a direct access level or **Remove** to revoke direct access. ## Use a Secret with a Launchable A Launchable creator first defines a [Text launch parameter](/concepts/launchables#launch-parameters) for the value that the workload expects. The parameter name controls the environment variable name; the secret name does not need to match it. #### Open the Launchable Open the Launchable's deployment page and sign in to the Brev Console. #### Choose Use a secret Find the Text parameter under **Setup values** and select **Use a secret**. #### Select a Secret and Version Select a secret that you can access in the active organization. Brev initially selects the version marked **Latest**; you can choose an earlier version instead. #### Deploy Complete the compute configuration and deploy the Launchable. Brev resolves the exact selected version and supplies its value to the parameter's startup path. Choice parameters do not support saved secrets. Enter or select one of their allowed values instead. Each deployment uses the exact version selected when the deployment is submitted. Creating a newer version does not update a deployment that is already staged or running. Select the new version the next time you deploy. ## Runtime Handling and Security Selecting a saved secret changes where a Launchable parameter value comes from, not how the workload receives it. The [runtime mode and value-lifetime behavior](/concepts/launchables#value-lifetime-and-visibility) is the same as for a manually entered Setup value. Brev stores saved secret versions encrypted at rest. During deployment, Brev resolves the selected version and uses a short-lived encrypted handoff to the startup process. The workload receives plaintext and can persist or expose it. Follow these practices: * Do not print secret values or enable shell tracing with `set -x`; setup output is captured in logs. * Do not put secret values in image names, labels, commands, notebooks, source code, or parameter defaults. * Treat users with root access, Docker access, or access to the receiving process as able to inspect runtime values. * Use credentials with minimum permissions and rotate them regularly. * Use a runtime secret manager when an application must retrieve a value continuously or after restarts. Removing access, creating a new version, or deleting the saved secret does not remove a value already delivered to a workload. ## Delete a Secret Open the secret, select **Delete**, and enter the secret name to confirm. Deleting a secret permanently deletes all of its saved versions and cannot be undone. Deletion does not remove copies already delivered to a workload. Update affected deployment workflows before deleting a secret. ## Troubleshooting | Problem | Resolution | | ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Secrets** or **Use a secret** is not available | The feature may not be enabled for your account. If **Secrets** is available but **Use a secret** is not, confirm that the parameter is Text; Choice parameters do not support saved secrets. | | A secret is missing from the picker | Confirm that the correct organization is active and that you have direct Reader or Maintainer access, or are an organization Owner, Admin, or Maintainer. | | You can see a secret but cannot reveal it | Organization Members can view metadata without value access. Ask someone with management access to grant Reader or Maintainer access. | | You cannot create a version or manage access | Reader access does not include management. Ask a Secret Maintainer or an organization Owner, Admin, or Maintainer. | | A new version is not used automatically | On the next deployment, select the new version under **Setup values**. Deployments use an exact version. | | A value is missing after startup | Review the [runtime mode behavior](/concepts/launchables#value-lifetime-and-visibility). Some modes expose parameters only during their startup script. | ## What's Next #### [Launchables](/concepts/launchables) Define launch parameters and understand where values are available at runtime. #### [Deploying NVIDIA NIMs](/guides/inference-deployment/deploying-nims) Use an NGC API key to run NVIDIA Inference Microservices.