> ## Documentation Index > Fetch the complete documentation index at: https://docs.duvo.ai/llms.txt > Use this file to discover all available pages before exploring further. # Secrets and Logins > Store env-var secrets and logins, and attach them to an Agent Revision so Runs can use them, with the Duvo CLI. Some Runs need credentials to do their work — an API key passed as an environment variable, or a username and password for a website or application the agent signs into. The CLI lets you store these securely and attach them to a specific Revision of an Agent. Values you store are **encrypted at rest and never echoed back** — listing a secret or login shows you which fields are set, not their values. Secrets and logins are **personal by default**. Pass `--shared` when creating one to make it available to the whole team (requires a manager role). ## Env-var secrets A secret holds one or more environment variables that are injected into a Run at runtime. ```bash theme={"dark"} duvo secrets list # list secrets you can see duvo secrets get # show one secret (which keys are set, not their values) duvo secrets create \ --name "Stripe API" \ --value STRIPE_API_KEY=sk_live_... # create a personal secret (repeat --value for multiple vars) duvo secrets create \ --name "Shared analytics" \ --value SEGMENT_KEY=... \ --shared # create a team-shared secret (requires manager role) duvo secrets update --name "New name" # rename or re-scope a secret duvo secrets delete # delete a secret (prompts unless -y) ``` `--value` takes a `KEY=VALUE` pair and can be repeated to store several variables under one secret. Use `--service-slug ` to tag a secret with the service it belongs to. ## Logins A login holds a website or application credential — domain, username, password, and optional TOTP secret — that the agent uses to sign in during a Run, in the browser or in desktop sessions (Computer Use and Windows Remote Desktop). ```bash theme={"dark"} duvo credentials list # list logins you can see duvo credentials list --domain example.com # filter by domain duvo credentials get # show one login (which fields are set, not their values) duvo credentials create \ --domain example.com \ --username alice@example.com \ --password "" # create a personal login duvo credentials create \ --domain example.com \ --username alice@example.com \ --otp-secret "" \ --shared # create a team-shared login (requires manager role) duvo credentials update --password "" # update a login duvo credentials delete # delete a login (prompts unless -y) ``` At least one of `--password` or `--otp-secret` must be provided when creating a login. The TOTP secret lets the agent generate one-time codes for sites that require two-factor authentication. ## Attaching to a Revision Storing a secret or login doesn't make it available to a Run on its own — you attach it to the specific Revision of an Agent whose Runs should use it. ```bash theme={"dark"} duvo revision-secrets list \ --agent --revision # list secrets attached to a Revision duvo revision-secrets attach \ --agent --revision \ --secret # attach a secret duvo revision-secrets detach \ --agent --revision [-y] # detach a secret (prompts unless -y) ``` ```bash theme={"dark"} duvo revision-logins list \ --agent --revision # list logins attached to a Revision duvo revision-logins attach \ --agent --revision \ --credential # attach a login duvo revision-logins detach \ --agent --revision [-y] # detach a login (prompts unless -y) ``` Use `duvo secrets list` and `duvo credentials list` to find the IDs to attach, and `duvo revisions list --agent ` to find Revision IDs. ## Related Find and create the Revisions you attach secrets and logins to For OAuth-based accounts (Gmail, Slack) rather than raw credentials