What problem does it solve?
Managing sensitive values like API keys, passwords, and tokens in MoonBit Golem agents requires a secure mechanism that keeps secrets out of source-controlled files while making them accessible at runtime. This Skill guides you through declaring, wiring, reading, and managing secrets in MoonBit agents on the Golem platform.
Core Features & Use Cases
- Typed Secret Declaration: Declare secret fields with
@config.Secret[T] inside #derive.config structs and inject them via @config.Config[T] in the agent constructor.
- Runtime Secret Access: Reveal secret values lazily with
.get!(), which pins the resolved revision for deterministic retries and can observe updates without restarting the agent.
- CLI Secret Management: Create, list, update, and delete environment-scoped secrets with
golem secret commands, plus secretDefaults in golem.yaml for local development.
- Use Case: You are building a MoonBit agent that calls an external API. Declare an
api_key : @config.Secret[String] field, create the secret with golem secret create apiKey --secret-type String --secret-value "sk-abc123", and read it at runtime with .get!().
Quick Start
Add a secret API key field to my MoonBit Golem agent's config struct and show me how to set its value with the golem CLI.