Secret management in generated CLI tools

Use this guide when a manifest defines CLI configuration containing tokens, passwords or other secret strings. The generator can provide a separate credentials command for storing those values in the system keyring where supported.

Mark secret inputs in the manifest

Set secret: true on a string-compatible CLI configuration field. For example, within a command's configuration list:

- name: Token
  lang_type: string
  mapstructure_tag: token
  description: Token used by the command.
  secret: true

For a structured configuration value, you can instead mark an individual bindings entry as secret. The generator validates the type: a secret field or binding must resolve to a string-compatible value. Consult the manifest schema for both secret fields and the manifest-authoring skill for authoring guidance.

Store and load credentials

If the CLI has secret-marked inputs but no Credentials command, the generator creates one from those inputs. If a Credentials command already exists, it merges the secret-marked inputs into that command. The generated command stores its configuration in the system keyring instead of invoking SDK operation logic, and no GitHub Action wrapper is generated for it.

In the generated tool, inspect <generated-binary> credentials --help for its inputs. Run the command with the required values to store them when the platform supports a system keyring. An unsupported keyring reports an error rather than silently storing the values elsewhere. go-sdk-generator itself has no credentials command unless its own manifest defines secret inputs.

Commands configured to load from the keyring use non-empty stored values ahead of CLI flags, environment variables, configuration files and defaults. Such commands expose --no-keyring to disable keyring loading for that invocation. The generated command reference describes configuration precedence; check the generated project's own command documentation for which commands enable keyring loading. A command cannot be configured to store to and load from the keyring at the same time.

Security boundaries