Sometimes there is no capability for what you need and the app really does have to hold a value. Raw secret references are supported, and they are deliberately a little uncomfortable.

​
Declare a reference

​
string
required
An uppercase environment-style identifier. Cannot collide with reserved TINY_* names.
​
string
required
The stored organization or app secret to resolve.
​
string
default:"latest"
Pin a specific version, or track latest.

​
Store a value

tiny secrets set reads the value from a prompt or piped stdin. It is deliberately not accepted as a command-line argument — that would put it in your shell history and in the process table.
secrets list returns names and creation times. Values are never returned by any API, and setting a name again creates a new version rather than overwriting.

​
Read one

Only secrets the manifest declared are resolvable. Values are delivered to the guest through MMDS, which the init blocks access to before any tenant code runs.

​
Why they are an approval signal

The default policy allows raw secrets but treats them as one. A raw secret the previous revision did not receive triggers RAW_SECRET_ACCESS on a production deploy, and the deployment pauses in awaiting_approval. The reasoning: a capability’s blast radius is a named operation with enforced constraints. A raw secret’s blast radius is whatever that credential can do anywhere, forever, and the platform cannot see it being used.
Before adding a secret, check whether http.request.send covers it. A grant naming the origins, methods, and path prefixes gives your app the same reach while the credential stays outside the microVM — and every call is audited.

​
How secrets are stored

Secrets are sealed with AES-256-GCM under a key derived per context from TINY_SECRET_KEY, so a ciphertext cannot be moved between organizations.
TINY_SECRET_KEY is the root of that. Losing it makes every stored connection credential and secret unrecoverable; leaking it compromises all of them. It is generated by tools/setup-cloud.sh and belongs in your backup of $TINY_DATA_DIR’s sibling configuration — see Backups.
KMS-backed envelope encryption is the intended replacement and is not implemented in this repository.

​
Reserved names

TINY_* is reserved for platform configuration delivered to the guest. A manifest that declares a secret in that namespace is rejected at validation, so nothing an app declares can shadow a platform variable.