Secrets - Phoenix

Use upsertOrDeleteSecrets from the @arizeai/phoenix-client/secrets entrypoint to create, rotate, or delete encrypted provider credentials in one atomic request.

Managing secrets requires an administrator when Phoenix authentication is enabled. Do not log the request batch or retain its values outside your credential store.

Create, Update, And Delete Secrets

Each batch entry has a key and a required value:

A string value creates or updates the secret.
null deletes the secret.
When a key occurs more than once, its last occurrence wins.

import { upsertOrDeleteSecrets } from "@arizeai/phoenix-client/secrets";

const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey) throw new Error("OPENAI_API_KEY is required");

const result = await upsertOrDeleteSecrets({
  secrets: [
    { key: "OPENAI_API_KEY", value: apiKey },
    { key: "OLD_PROVIDER_API_KEY", value: null },
  ],
});

console.log(result.upsertedKeys);
console.log(result.deletedKeys);

The operation returns only upsertedKeys and deletedKeys. Submitted secret values are never returned or added to helper error messages.

Use An Explicit Client

Pass client when you need to target a particular Phoenix instance. Otherwise, the helper creates a client from the standard Phoenix environment configuration.

import { createClient } from "@arizeai/phoenix-client";
import { upsertOrDeleteSecrets } from "@arizeai/phoenix-client/secrets";

const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey) throw new Error("OPENAI_API_KEY is required");

const client = createClient({
  options: { baseUrl: "https://phoenix.example.com" },
});

await upsertOrDeleteSecrets({
  client,
  secrets: [{ key: "OPENAI_API_KEY", value: apiKey }],
});

Source Map

src/secrets/index.ts
src/secrets/upsertOrDeleteSecrets.ts
src/client.ts
src/generated/api/v1.ts