coder · evgeniy-scherbina · Jul 7, 2025 · Jul 8, 2025 · Jul 8, 2025 · Jul 8, 2025
@@ -98,6 +98,14 @@ message Manifest {
 	repeated WorkspaceApp apps = 11;
 	repeated WorkspaceAgentMetadata.Description metadata = 12;
 	repeated WorkspaceAgentDevcontainer devcontainers = 17;
+
+  map<string,Secret> user_secrets = 19;
+}
+
+message Secret {
+  string name = 1;
+  string env_name = 2;
+  string file_path = 3;
 }
 
 message WorkspaceAgentDevcontainer {

diff --git a/cli/root.go b/cli/root.go
@@ -99,6 +99,7 @@ func (r *RootCmd) CoreSubcommands() []*serpent.Command {
 		r.portForward(),
 		r.publickey(),
 		r.resetPassword(),
+		r.secrets(),
 		r.state(),
 		r.templates(),
 		r.tokens(),

diff --git a/cli/testdata/coder_--help.golden b/cli/testdata/coder_--help.golden
@@ -42,6 +42,7 @@ SUBCOMMANDS:
                       password
     restart           Restart a workspace
     schedule          Schedule automated start and stop times for workspaces
+    secrets           Manage your user secrets
     server            Start a Coder server
     show              Display details of a workspace's resources and agents
     speedtest         Run upload and download tests from your machine to a

diff --git a/cli/testdata/coder_secrets_--help.golden b/cli/testdata/coder_secrets_--help.golden
@@ -0,0 +1,14 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder secrets
+
+  Manage your user secrets
+
+SUBCOMMANDS:
+    create    Create a new user secret
+    get       Get user secret
+    list      List user secrets
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_secrets_create_--help.golden b/cli/testdata/coder_secrets_create_--help.golden
@@ -0,0 +1,16 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder secrets create [flags] <name>
+
+  Create a new user secret
+
+OPTIONS:
+      --description string
+          Description of the secret.
+
+      --value string
+          Value of the secret (required).
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_secrets_get_--help.golden b/cli/testdata/coder_secrets_get_--help.golden
@@ -0,0 +1,13 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder secrets get [flags] <name>
+
+  Get user secret
+
+OPTIONS:
+      --with-value bool
+          Display value of the secret.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_secrets_list_--help.golden b/cli/testdata/coder_secrets_list_--help.golden
@@ -0,0 +1,9 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder secrets list
+
+  List user secrets
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/user_secrets.go b/cli/user_secrets.go
@@ -0,0 +1,150 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/serpent"
+)
+
+func (r *RootCmd) secrets() *serpent.Command {
+	return &serpent.Command{
+		Use:   "secrets",
+		Short: "Manage your user secrets",
+		Handler: func(inv *serpent.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+		Children: []*serpent.Command{
+			r.secretCreate(),
+			r.secretList(),
+			r.secretGet(),
+		},
+	}
+}
+
+func (r *RootCmd) secretCreate() *serpent.Command {
+	client := new(codersdk.Client)
+	var value string
+	var description string
+	var envName string
+	var filePath string
+	cmd := &serpent.Command{
+		Use:   "create <name>",
+		Short: "Create a new user secret",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(1),
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			name := inv.Args[0]
+			if value == "" {
+				return fmt.Errorf("--value is required")
+			}
+			secret, err := client.CreateUserSecret(inv.Context(), codersdk.CreateUserSecretRequest{
+				Name:        name,
+				Value:       value,
+				Description: description,
+				EnvName:     envName,
+				FilePath:    filePath,
+			})
+			if err != nil {
+				return err
+			}
+			fmt.Fprintf(inv.Stdout, "Created user secret %q (ID: %s)\n", secret.Name, secret.ID)
+			return nil
+		},
+	}
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:        "value",
+			Description: "Value of the secret (required).",
+			Value:       serpent.StringOf(&value),
+		},
+		{
+			Flag:        "description",
+			Description: "Description of the secret.",
+			Value:       serpent.StringOf(&description),
+		},
+		{
+			Flag:        "env_name",
+			Description: "Environment variable name of the secret.",
+			Value:       serpent.StringOf(&envName),
+		},
+		{
+			Flag:        "file_path",
+			Description: "File path of the secret.",
+			Value:       serpent.StringOf(&filePath),
+		},
+	}
+	return cmd
+}
+
+func (r *RootCmd) secretList() *serpent.Command {
+	client := new(codersdk.Client)
+	cmd := &serpent.Command{
+		Use:   "list",
+		Short: "List user secrets",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(0),
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			secretList, err := client.ListUserSecrets(inv.Context())
+			if err != nil {
+				return err
+			}
+			fmt.Fprintf(inv.Stdout, "ID | Name | Description | EnvName | FilePath\n")
+			for _, secret := range secretList.Secrets {
+				fmt.Fprintf(inv.Stdout, "%v - %v - %v - %v - %v\n",
+					secret.ID, secret.Name, secret.Description, secret.EnvName, secret.FilePath)
+			}
+			return nil
+		},
+	}
+	cmd.Options = serpent.OptionSet{}
+	return cmd
+}
+
+func (r *RootCmd) secretGet() *serpent.Command {
+	client := new(codersdk.Client)
+	var withValue bool
+	cmd := &serpent.Command{
+		Use:   "get <name>",
+		Short: "Get user secret",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(1),
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			secretName := inv.Args[0]
+			secret, err := client.GetUserSecret(inv.Context(), secretName)
+			if err != nil {
+				return err
+			}
+
+			userSecretValue := codersdk.UserSecretValue{
+				Value: "hidden",
+			}
+			if withValue {
+				userSecretValue, err = client.GetUserSecretValue(inv.Context(), secretName)
+				if err != nil {
+					return err
+				}
+			}
+			value := userSecretValue.Value
+
+			fmt.Fprintf(inv.Stdout, "ID | Name | Description | Value | EnvName | FilePath\n")
+			fmt.Fprintf(inv.Stdout, "%v - %v - %v - %v - %v - %v\n",
+				secret.ID, secret.Name, secret.Description, value, secret.EnvName, secret.FilePath)
+			return nil
+		},
+	}
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:        "with-value",
+			Description: "Display value of the secret.",
+			Value:       serpent.BoolOf(&withValue),
+		},
+	}
+	return cmd
+}