Manage secrets as a lifecycle

Verifiedon 2026-07-302026.7.1

A secret is a capability with a clock

Use the current OpenClaw secrets documentation and plan contract to choose a supported storage and application method. This lesson does not publish a configuration snippet because secret placement depends on the deployment. The invariant is portable: an agent receives only the credential required for its bounded job, for no longer than necessary.

Lab — create the inventory and rehearse revocation

For each credential, record an opaque reference—not its value—plus owner, purpose, issuer, scope, environment, expiry, rotation path, revocation owner, and where it may appear. Search logs, transcripts, diagnostics, screenshots, and repository history for accidental disclosure before you call the inventory complete.

In a sandbox, revoke a deliberately disposable credential. Then verify three facts: the old credential fails; the intended replacement works only for its intended scope; and the audit record identifies the time and actor. Record what cannot be revoked quickly, such as third-party cache or downstream session uncertainty, as residual risk.

Learner artifact

Show a one-way flow: issuer → managed secret reference → gateway/agent consumer → scoped service. Draw a red break symbol at revocation and a separate line to logs that contains references and outcomes, never values.

Quiz

What is the correct response when a secret appears in a prompt transcript? Treat it as exposed: revoke or rotate it, preserve minimal incident evidence, remove further distribution, and investigate the path. Redacting the visible transcript alone does not restore trust.

Completion check

A reviewer should be able to choose any inventory row and find its owner, revocation procedure, last test, and residual risk without seeing the credential itself.