golem-add-secret-ts

To manage secrets in TypeScript Golem agents without hardcoding, model sensitive configuration as Secret<T> fields in your config types and retrieve values on demand at runtime using the .get() method. This keeps values out of golem.yaml and source code.

The Secret<T> type models sensitive values in TypeScript config so they are fetched on demand. At runtime, calling Secret<T>.get() retrieves the live secret value when connecting to external services or performing authenticated operations.

You can manage the secret lifecycle for per-environment storage by using golem secret commands to create, list, update, and delete secrets. This CLI-driven approach supports proper secret typing without embedding values in configuration files.

Yes, Secret<T> supports per-environment confidential configuration including database credentials, API keys, and tokens. You declare the secret fields in your TypeScript config types and use golem secret commands to store values for each environment separately.

The best way to add authentication credentials to a Golem agent is declaring Secret<T> fields in your TypeScript config types to model sensitive values, then retrieving them at runtime via .get() and managing their lifecycle through golem secret commands.

You should avoid putting secret values in golem.yaml because it exposes sensitive configuration in source files. Instead, modeling secrets as Secret<T> fields ensures values are retrieved on demand at runtime, keeping confidential data out of source code and static config.