> ## Documentation Index
> Fetch the complete documentation index at: https://arizeai-433a7140.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Atomically manage encrypted provider credentials with the Phoenix TypeScript client

Use `upsertOrDeleteSecrets` from the `@arizeai/phoenix-client/secrets` entrypoint to create, rotate, or delete encrypted provider credentials in one atomic request.

<Warning>
  Managing secrets requires an administrator when Phoenix authentication is enabled. Do not log the request batch or retain its values outside your credential store.
</Warning>

## Create, Update, And Delete Secrets

Each batch entry has a `key` and a required `value`:

* A string value creates or updates the secret.
* `null` deletes the secret.
* When a key occurs more than once, its last occurrence wins.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { upsertOrDeleteSecrets } from "@arizeai/phoenix-client/secrets";

const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey) throw new Error("OPENAI_API_KEY is required");

const result = await upsertOrDeleteSecrets({
  secrets: [
    { key: "OPENAI_API_KEY", value: apiKey },
    { key: "OLD_PROVIDER_API_KEY", value: null },
  ],
});

console.log(result.upsertedKeys);
console.log(result.deletedKeys);
```

The operation returns only `upsertedKeys` and `deletedKeys`. Submitted secret values are never returned or added to helper error messages.

## Use An Explicit Client

Pass `client` when you need to target a particular Phoenix instance. Otherwise, the helper creates a client from the standard Phoenix environment configuration.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { createClient } from "@arizeai/phoenix-client";
import { upsertOrDeleteSecrets } from "@arizeai/phoenix-client/secrets";

const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey) throw new Error("OPENAI_API_KEY is required");

const client = createClient({
  options: { baseUrl: "https://phoenix.example.com" },
});

await upsertOrDeleteSecrets({
  client,
  secrets: [{ key: "OPENAI_API_KEY", value: apiKey }],
});
```

<section className="hidden" data-agent-context="source-map" aria-label="Source map">
  <h2>Source Map</h2>

  <ul>
    <li><code>src/secrets/index.ts</code></li>
    <li><code>src/secrets/upsertOrDeleteSecrets.ts</code></li>
    <li><code>src/client.ts</code></li>
    <li><code>src/**generated**/api/v1.ts</code></li>
  </ul>
</section>