> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.vessl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage secrets

> Update, rotate, and delete org-level secrets — the operations reserved for Organization admins.

Secrets are encrypted, organization-scoped credentials that any member can create and use in a batch job — see [Secrets](/member/settings/secrets) for what they are, how the encryption works, and how to create and inject them. This page covers the operations reserved for **Organization admin**: updating and deleting secrets.

## Permissions

| Operation                                           | Who can perform it          |
| --------------------------------------------------- | --------------------------- |
| Create                                              | Anyone in the organization  |
| View list and metadata                              | Anyone in the organization  |
| Update (rotate value, rename key, edit description) | **Organization admin** only |
| Delete                                              | **Organization admin** only |

There is no creator exception: a member can't update or delete a secret they created themselves. Members don't see the edit and delete controls on the secrets list — the row menu appears for admins only.

<div>
  <Frame>
    <img src="https://mintcdn.com/dora/ak9sJWQAzmPhmU9G/images/secrets-list.png?fit=max&auto=format&n=ak9sJWQAzmPhmU9G&q=85&s=5ed521d773d2cabb120062227bda9165" alt="Secrets page as an admin sees it, with a table of secrets and a row menu for editing and deleting each secret" width="3840" height="2160" data-path="images/secrets-list.png" />
  </Frame>

  <small>Example: Secrets page as an admin sees it — each row has an edit and delete menu</small>
</div>

<Tip>Watch a short demo of creating, editing, and deleting a secret on VESSL Cloud.</Tip>

<div style={{ position: 'relative', paddingBottom: 'calc(54.6667% + 41px)', height: 0, width: '100%' }}>
  <iframe src="https://demo.arcade.software/S8SGCX1f0agjZ3AzQZ2j?embed&embed_mobile=inline&embed_desktop=inline&show_copy_link=true" title="Create and Update a Secret on VESSL Cloud" frameBorder="0" loading="lazy" webkitAllowFullScreen="" mozAllowFullScreen="" allowFullScreen allow="clipboard-write" style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%', colorScheme: 'light' }} />
</div>

## Update a secret

Rotate the value, rename the env-var key, or edit the description. Secret values are write-only: after a secret is saved, no one can view the value again, so rotation means overwriting it with a new value — the previous value can't be retrieved.

### GUI

1. In the sidebar, select **Settings**.
2. Select **Secrets** under **Account**.
3. Open the row menu on the secret and select **Edit**.
4. Edit the **Key** or enter a new **Value**, then save. Every key-value pair is overwritten in this secret. (The secret name is fixed; description editing is CLI-only.)

### CLI

```bash theme={null}
# Rotate the value (interactive prompt)
vesslctl secret update <slug>

# Rotate the value from an env var
vesslctl secret update <slug> --from-env NEW_HF_TOKEN

# Rename the env-var key (metadata-only, no value rotation)
vesslctl secret update <slug> --key NEW_KEY

# Edit the description
vesslctl secret update <slug> --description "Rotated 2026-05"
```

<Note>
  Running workloads do **not** pick up updated secret values automatically. Restart the workload to use the new value.
</Note>

## Delete a secret

### GUI

1. In the sidebar, select **Settings**.
2. Select **Secrets** under **Account**.
3. Open the row menu on the secret and select **Delete**.

### CLI

```bash theme={null}
# Delete (with confirmation)
vesslctl secret delete <slug>

# Delete without confirmation
vesslctl secret delete <slug> -y

# Include soft-deleted entries when listing
vesslctl secret list --include-deleted
```

Deletion is a **soft delete**: deleted secrets are kept for audit, and their names become available for reuse immediately.

## FAQ

<AccordionGroup>
  <Accordion title="Who can manage secrets?">
    Anyone in the organization can view secrets and create new ones. Updating or deleting a secret — including one the member created themselves — requires the **Organization admin** role, so members don't see the edit and delete controls on the secrets list.
  </Accordion>

  <Accordion title="Do running workloads see updated secret values?">
    No. Secrets are injected at container start. Restart the workload to pick up the new value.
  </Accordion>

  <Accordion title="Can I reuse a deleted secret's name?">
    Yes. Deleted secrets are soft-deleted, so the name becomes available immediately. Pass `--include-deleted` to `vesslctl secret list` to inspect the history.
  </Accordion>
</AccordionGroup>