Secrets

AWS Secrets Manager + KMS. Per-tenant scoped.

client.secrets.put("OPENAI_API_KEY", "sk-...")
client.secrets.list()

Names must be UPPER_SNAKE_CASE. Values are never plaintext at rest and never logged.