Secrets

telnyx-acp add secret OPENAI_API_KEY

support-agent/
├── agent.json                                         ◀
├── instructions.md
└── .telnyx/                        written by deploy
    ├── index.ts
    ├── telnyx.toml                                    ◀
    ├── telnyx-env.d.ts
    └── package.json

@telnyx/acp/                      the package
├── managed/
│   ├── index.ts
│   ├── agent.ts                                       ◀
│   ├── model.ts                                       ◀
│   ├── memory.ts
│   ├── tools.ts
│   ├── mcp.ts
│   ├── voice.ts
│   ├── direct-turn.ts
│   └── filler.ts
├── channels/
│   ├── index.ts
│   ├── phone.ts
│   ├── email.ts
│   ├── web.ts
│   └── wire.ts
├── synth/
│   ├── index.ts                                       ◀
│   ├── code-entry.ts
│   └── vendor.ts
└── spec/
    ├── schema.ts
    ├── model.ts                                       ◀
    ├── phone.ts
    ├── project.ts
    └── io.ts

add secret NAME prompts for the value, stores it on the platform, and appends the name to secrets. At deploy, manifest() in synth/index.ts writes one [[secrets]] entry per name into .telnyx/telnyx.toml, after the function’s identity, the actor and the Telnyx binding:

# Generated by `telnyx-acp deploy` from agent.json. Do not edit; never commit.
name = "support-agent"
main = "index.ts"
compatibility_date = "2026-10-01"

[edge_compute]
func_id = "…"
func_name = "support-agent"

[[actors]]
binding = "SUPPORT_AGENT"
type = "SupportAgent"

[telnyx]
binding = "TELNYX"

[[secrets]]
binding = "OPENAI_API_KEY"
name = "OPENAI_API_KEY"

The class reads each secret through env.SECRETS.get(name), on the instance’s env. A third-party model’s key is read by modelKey in managed/agent.ts under the name that spec/model.ts maps the provider to, and managed/model.ts sends it as api_key on each request.

Provider	Secret
`openai/*`	`OPENAI_API_KEY`
`anthropic/*`	`ANTHROPIC_API_KEY`
`google/*`	`GOOGLE_API_KEY`
`groq/*`	`GROQ_API_KEY`

modelKey reads the secret:

// managed/agent.ts
async function modelKey(env, model) {
  const secret = modelKeySecret(model);
  if (!secret || !env.SECRETS) return undefined;
  try {
    return (await env.SECRETS.get(secret)) || undefined;
  } catch {
    return undefined;
  }
}

env.SECRETS is the secrets binding of the instance’s env, present when telnyx.toml declares a secret.

secret is the name that modelKeySecret maps the provider to, as in the table.
A missing binding, a missing secret or a failed read leaves the key out. The inference API then answers with what it needs, and that answer is written to state as lastError.

Get Started

Inside the Managed Harness

The Agent Harness SDK

The Agent Runtime SDK

The Agent Client SDK

For AI Agents