Agentic Data Plane

Manage Secrets

Store the API keys, tokens, and certificates your LLM providers, MCP servers, OAuth providers, and triggers need in the Redpanda Agentic Data Plane secret store. Those resources reference a secret by its ID, so each credential lives in one place and no one can read it back. When a credential changes, you update one secret instead of editing everything that uses it.

After reading this page, you will be able to:

  • Create a secret in the secret store and reference it from an LLM provider or MCP server

  • Rotate a secret’s value or update its tags without changing its ID

  • Grant someone access to view, change, or delete secrets

Prerequisites

You need permission to create, update, and delete secrets. The Admin role carries it, as do policies built from the adp-standard and adp-full templates. The built-in Owner lifecycle policy also lets you update and delete secrets you created. See Who can manage secrets.

How secrets work

A secret has an ID, a value, and optional tags:

  • ID: The name other resources use to reference the secret, such as OPENAI_API_KEY. An ID starts with a letter and uses only uppercase letters, numbers, and underscores, up to 255 characters. You can’t change it after you create the secret.

  • Value: The credential itself, up to 64 KiB. The value is write-only. After you save it, neither the UI nor anyone with access to the secret can read it back.

  • Tags: Key-value pairs for organizing secrets and for writing access policy conditions. For the limits and rules that apply to tags on every resource, see Tag Resources. To use tags in policy conditions, see Attribute reference.

The secret pickers on provider and server forms list only the secrets in the Agentic Data Plane secret store, which are the ones AI Gateway can read. The pickers don’t show a secret that Redpanda Cloud holds for another product, such as a Redpanda Connect pipeline, and a new secret can’t reuse that secret’s name.

Create a secret

  1. Open Secrets store in the sidebar.

  2. Click Create secret.

  3. Enter the ID. The field uppercases what you type.

  4. Under Value, select a format:

    • Single line: For API keys and tokens. The value can’t start or end with a space or line break.

    • Multiline: For PEM keys, JSON, or other values with line breaks. The form removes a final line break.

  5. Enter the value.

  6. Optional: Under Tags, enter a tag key and value, and then click the plus button or press Enter. Repeat for each tag.

  7. Click Create secret.

To use the secret, select it by ID in the credential field of an LLM provider, MCP server, OAuth provider, or trigger. See Configure an LLM Provider and Create an MCP Server.

You can also create a secret without leaving those forms. Their credential fields let you store a new value in place. Agentic Data Plane saves it to the secret store.

To script secrets instead, see Manage secrets with rpk ai.

Find a secret

Open Secrets store in the sidebar. The list shows each secret’s ID and tags. Search by ID, or filter by tag.

To see one secret, open its row menu and click View details. The details page shows the ID and tags. It never shows the value.

Rotate a value or change tags

  1. Open Secrets store in the sidebar.

  2. Open the secret’s row menu and click Edit.

  3. To rotate the credential, enter the new value. To keep the current value, leave the field blank.

  4. To change tags, edit the list under Tags.

  5. Click Save changes.

If someone else saved the secret after you opened it, the save fails and asks you to reload the page. Reload, then make your changes again.

When a new value takes effect

Resources keep their reference to the secret’s ID, so you don’t edit them after a rotation. How soon each one uses the new value depends on the resource:

  • OpenAI, Anthropic, and Google LLM providers: Within about five minutes.

  • Amazon Bedrock LLM providers: On the next request.

  • Self-managed MCP servers that authenticate with a static key or with service account OAuth: On the next call.

  • Managed MCP servers that use a secret, such as GitHub (Read) with a shared token: Within about ten minutes.

Delete a secret

Deleting a secret is permanent. You can’t recover the stored value, and any MCP server, AI agent, or other resource that references the secret loses access. Agentic Data Plane doesn’t check whether anything still uses a secret before deleting it. Find and update those resources first.

  1. Open Secrets store in the sidebar.

  2. Open the secret’s row menu and click Delete.

  3. Type the secret’s ID to confirm, and click Delete.

To delete a secret from its details page instead, click Delete secret, type delete to confirm, and click Delete. To delete several secrets together, select their rows in the list, click the Delete button that shows how many you selected, and confirm.

Manage secrets with rpk ai

The rpk ai secret commands work on the same secrets as the Secrets store page and need the same permissions, so you can script secrets in continuous integration (CI). Each command takes a secret’s bare ID, such as OPENAI_API_KEY, or its resource name, secrets/OPENAI_API_KEY. No command prints a stored value.

Sign in and select an environment before you run them. See Connect to an AI Gateway.

Create a secret

Pass the value with --value-file, which reads a file, or standard input when you write --value-file=-:

printf %s "$OPENAI_API_KEY" | rpk ai secret create OPENAI_API_KEY --value-file=- --tag team=platform
rpk ai secret create GCP_SERVICE_ACCOUNT_KEY --value-file ./service-account.json

Keep the equals sign in --value-file=-. rpk drops a - passed as a separate argument, so --value-file - fails.

--value-file strips one trailing line break, so a value piped from echo or read from a file that ends in a newline is stored without it. The --value flag takes the value inline instead, which leaves the credential in your shell history and the process list. Repeat --tag KEY=VALUE for each tag.

IDs follow the rules in How secrets work, but the CLI doesn’t uppercase them for you. It rejects an ID such as openai-api-key and suggests OPENAI_API_KEY.

To use the secret, pass its ID to a flag that ends in -ref, such as --openai-config.api-key-ref on rpk ai llm-provider create or --remote.static-key.key-secret-ref on rpk ai mcp-server create. These flags take a secret ID, never the credential itself.

Find a secret

List secrets by tag or by part of their ID, or get one secret:

rpk ai secret list --tag team=platform
rpk ai secret list --name-contains openai
rpk ai secret get OPENAI_API_KEY

list prints each secret’s ID and tags, and who created it. Repeat --tag to require several tags. --name-contains matches part of the ID and ignores case. To filter on another field, such as who last updated a secret, use --filter. See rpk ai secret list.

get also prints when the secret was created and last updated. Add -o wide to list for the same times, or -o json to either command for the full record. See Format command output.

Rotate a value or change tags

update changes only what you pass. To rotate the credential, pass the new value. To change tags, pass --tag to add or overwrite a tag, or --remove-tag to drop one. Tags you don’t name keep their values.

printf %s "$NEW_OPENAI_API_KEY" | rpk ai secret update OPENAI_API_KEY --value-file=-
rpk ai secret update OPENAI_API_KEY --tag env=prod --remove-tag stale

A tag change reads the secret before it writes, so it also needs Secret.get. If someone else changes the secret between the read and the write, the update fails instead of overwriting their change. Run the command again. Passing --remove-tag for a tag the secret doesn’t have prints a note instead of failing, so a script can rerun the same command.

Resources pick up a rotated value on the same schedule as a rotation in the UI. See When a new value takes effect.

Delete a secret

Delete a secret by its ID:

rpk ai secret delete OPENAI_API_KEY

The command doesn’t ask you to confirm. Like the UI, it doesn’t check whether anything still references the secret.

To delete a secret only if nobody changed it since you read it, pass the etag from its full record. This example uses jq to read it:

etag=$(rpk ai secret get OPENAI_API_KEY -o json | jq -r .etag)
rpk ai secret delete OPENAI_API_KEY --etag "$etag"

Who can manage secrets

You grant access to secrets with access policies on the Secret actions: Secret.get, Secret.list, Secret.create, Secret.update, and Secret.delete.

Who Secret access

Admin role

All five actions

Policies from the adp-standard or adp-full template

All five actions

Policies from the adp-readonly or adp-sandboxed template

Secret.get and Secret.list

The person who created a secret

Secret.get, Secret.update, and Secret.delete on that secret, through the built-in Owner lifecycle policy

Granting Secret.get or Secret.list discloses a secret’s ID and tags, never its value. To limit someone to some secrets, write a policy condition on the secret’s tags. See Manage Access Policies and Secret permissions.

Next steps