---
product: Chilkat
product_version: 11.7.0
language: tcl
language_label: Tcl
class: Secrets
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/tclSecretsRef.html
---
# Chilkat Secrets — Tcl — v11.7.0

> Chilkat 11.7.0 · language=tcl · class=Secrets
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Secrets.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/guide.md`.

## Purpose

**Manage application secrets through one consistent API.**

`Chilkat.Secrets` provides a unified interface for storing, retrieving, listing, and deleting secrets across local, cloud-based, and in-memory secret stores. It supports string, binary, and JSON secrets, making it useful for passwords, API keys, OAuth credentials, tokens, unlock codes, certificates, and private configuration data.

**Local secure storage**

- Windows Credential Manager
- Apple Keychain

**Cloud secret managers**

- AWS Secrets Manager
- Azure Key Vault
- IBM Cloud Secrets Manager
- Oracle Cloud Secrets
- Doppler Secrets

**Temporary secrets**

Use in-memory secrets when values should exist only for the lifetime of the running process.

**Flexible content types**

Store and retrieve secrets as strings, binary data, or structured JSON.

**Note:** Cloud-based secret managers often require local bootstrap credentials. These can be stored securely in the Windows Credential Manager or Apple Keychain and then used to authenticate to the cloud secret manager.

Start with the [Conceptual Overview](https://www.chilkatsoft.com/chilkat_secrets_api.asp) and [Components of a Secret Name](https://www.chilkatsoft.com/components_of_a_secret_name.asp). For an extended overview, see the [Secrets Class Overview](https://www.chilkatsoft.com/secrets_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```tcl
# 'this' is not a keyword in Tcl. It can freely be used as a variable name.
set this [new CkSecrets]
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Tcl.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `string # ckStr is a CkString CkSecrets_get_DebugLogFilePath $this $ckStr set strVal [CkSecrets_get_debugLogFilePath $this] CkSecrets_put_DebugLogFilePath $this $strVal` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `string # ckStr is a CkString CkSecrets_get_LastErrorHtml $this $ckStr set strVal [CkSecrets_get_lastErrorHtml $this]` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `string # ckStr is a CkString CkSecrets_get_LastErrorText $this $ckStr set strVal [CkSecrets_get_lastErrorText $this]` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `string # ckStr is a CkString CkSecrets_get_LastErrorXml $this $ckStr set strVal [CkSecrets_get_lastErrorXml $this]` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `boolean 1/0 set boolVal [CkSecrets_get_LastMethodSuccess $this] CkSecrets_put_LastMethodSuccess $this $boolVal` | read/write | Indicates the success or failure of the most recent method call: `1` means success, `0` means failure. |
| `Utf8` | `boolean 1/0 set boolVal [CkSecrets_get_Utf8 $this] CkSecrets_put_Utf8 $this $boolVal` | read/write | When set to `1`, all `string` arguments and return values are interpreted as UTF-8 strings. |
| `VerboseLogging` | `boolean 1/0 set boolVal [CkSecrets_get_VerboseLogging $this] CkSecrets_put_VerboseLogging $this $boolVal` | read/write | If set to `1`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `string # ckStr is a CkString CkSecrets_get_Version $this $ckStr set strVal [CkSecrets_get_version $this]` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AutoSplit` | property, read/write | `boolean 1/0 set boolVal [CkSecrets_get_AutoSplit $this] CkSecrets_put_AutoSplit $this $boolVal` |
| `Compression` | property, read/write | `boolean 1/0 set boolVal [CkSecrets_get_Compression $this] CkSecrets_put_Compression $this $boolVal` |
| `Location` | property, read/write | `string # ckStr is a CkString CkSecrets_get_Location $this $ckStr set strVal [CkSecrets_get_location $this] CkSecrets_put_Location $this $strVal` |
| `UncommonOptions` | property, read/write | `string # ckStr is a CkString CkSecrets_get_UncommonOptions $this $ckStr set strVal [CkSecrets_get_uncommonOptions $this] CkSecrets_put_UncommonOptions $this $strVal` |
| `DeleteSecret` | method | `# jsonId is a CkJsonObject set status [CkSecrets_DeleteSecret $this $jsonId]` |
| `GetSecretBd` | method | `# jsonId is a CkJsonObject # bd is a CkBinData set status [CkSecrets_GetSecretBd $this $jsonId $bd]` |
| `GetSecretJson` | method | `# jsonId is a CkJsonObject # jsonOut is a CkJsonObject set status [CkSecrets_GetSecretJson $this $jsonId $jsonOut]` |
| `GetSecretSb` | method | `# jsonId is a CkJsonObject # sb is a CkStringBuilder set status [CkSecrets_GetSecretSb $this $jsonId $sb]` |
| `GetSecretStr` | method | `# jsonId is a CkJsonObject # outStr is a CkString (output) set status [CkSecrets_GetSecretStr $this $jsonId $outStr] set retStr [CkSecrets_getSecretStr $this $jsonId]` |
| `ListSecrets` | method | `# json is a CkJsonObject # jsonOut is a CkJsonObject set status [CkSecrets_ListSecrets $this $json $jsonOut]` |
| `SecretSpecToJson` | method | `# secretSpec is a string # json is a CkJsonObject set status [CkSecrets_SecretSpecToJson $this $secretSpec $json]` |
| `SetBootstrapSecret` | method | `# jsonId is a CkJsonObject # secretContent is a CkSecrets set status [CkSecrets_SetBootstrapSecret $this $jsonId $secretContent]` |
| `UpdateSecretBd` | method | `# jsonId is a CkJsonObject # secret is a CkBinData set status [CkSecrets_UpdateSecretBd $this $jsonId $secret]` |
| `UpdateSecretJson` | method | `# jsonId is a CkJsonObject # secret is a CkJsonObject set status [CkSecrets_UpdateSecretJson $this $jsonId $secret]` |
| `UpdateSecretSb` | method | `# jsonId is a CkJsonObject # sb is a CkStringBuilder set status [CkSecrets_UpdateSecretSb $this $jsonId $sb]` |
| `UpdateSecretStr` | method | `# jsonId is a CkJsonObject # secret is a string set status [CkSecrets_UpdateSecretStr $this $jsonId $secret]` |

## Properties

### Secrets.AutoSplit

`Chilkat 11.7.0 · tcl · Secrets · AutoSplit · property · read/write · since 10.1.0`

```tcl
boolean 1/0
set boolVal [CkSecrets_get_AutoSplit $this]

CkSecrets_put_AutoSplit $this $boolVal
```

The AutoSplit property is specific to `local_manager` secrets on Windows. The Windows Credentials Manager supports a maximum of 2560 bytes per secret. If a secret exceeds this size, it will be automatically compressed and split when created or updated, and automatically recomposed when retrieved.

A secret can be split into a maximum of 10 parts.

The default value is `1`.

### Secrets.Compression

`Chilkat 11.7.0 · tcl · Secrets · Compression · property · read/write · since 10.1.0`

```tcl
boolean 1/0
set boolVal [CkSecrets_get_Compression $this]

CkSecrets_put_Compression $this $boolVal
```

If set to `1`, then the contents of the secret will be stored compressed. The default value of this property is `0`.

### Secrets.Location

`Chilkat 11.7.0 · tcl · Secrets · Location · property · read/write · since 10.1.0`

```tcl
string
# ckStr is a CkString

CkSecrets_get_Location $this $ckStr

set strVal [CkSecrets_get_location $this]

CkSecrets_put_Location $this $strVal
```

The location of the secrets. Possible values are:

- `local_manager` - On Windows this is the Credentials Manager. On MacOS and iOS it is the Keychain. This is not yet an option on Linux or Android.
- `aws_secrets_manager` - AWS Secrets Manager
- `azure_key_vault` - Azure Key Vault
- `ibm_cloud` - IBM Cloud Secrets Manager
- `oracle_cloud` - Oracle Cloud Secrets
- `doppler` - Doppler Secrets
- `memory` - In-Memory Secrets

The default location is the `local_manager`. On Linux and Android, `local_manager` will behave the same as `memory`.

### Secrets.UncommonOptions

`Chilkat 11.7.0 · tcl · Secrets · UncommonOptions · property · read/write · since 10.1.0`

```tcl
string
# ckStr is a CkString

CkSecrets_get_UncommonOptions $this $ckStr

set strVal [CkSecrets_get_uncommonOptions $this]

CkSecrets_put_UncommonOptions $this $strVal
```

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.

## Methods

### Secrets.DeleteSecret

`Chilkat 11.7.0 · tcl · Secrets · DeleteSecret · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

set status [CkSecrets_DeleteSecret $this $jsonId]
```

Deletes a secret. Cloud secrets managers will typically disable the secret and schedule the secret for deletion after some number of days.

Returns 1 for success, 0 for failure.

Async variant: `DeleteSecretAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.GetSecretBd

`Chilkat 11.7.0 · tcl · Secrets · GetSecretBd · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# bd is a CkBinData

set status [CkSecrets_GetSecretBd $this $jsonId  $bd]
```

Fetches a binary secret and returns the content in `bd`.

Returns 1 for success, 0 for failure.

Async variant: `GetSecretBdAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.GetSecretJson

`Chilkat 11.7.0 · tcl · Secrets · GetSecretJson · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# jsonOut is a CkJsonObject

set status [CkSecrets_GetSecretJson $this $jsonId  $jsonOut]
```

Fetches a JSON secret and returns the content in `jsonOut`.

Returns 1 for success, 0 for failure.

Async variant: `GetSecretJsonAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.GetSecretSb

`Chilkat 11.7.0 · tcl · Secrets · GetSecretSb · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# sb is a CkStringBuilder

set status [CkSecrets_GetSecretSb $this $jsonId  $sb]
```

Fetches a string secret and returns the content in `sb`.

Returns 1 for success, 0 for failure.

Async variant: `GetSecretSbAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.GetSecretStr

`Chilkat 11.7.0 · tcl · Secrets · GetSecretStr · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# outStr is a CkString (output)

set status [CkSecrets_GetSecretStr $this $jsonId $outStr]

set retStr [CkSecrets_getSecretStr $this $jsonId]
```

Fetches a string secret and returns the content of the secret.

Returns 1 for success, 0 for failure.

Async variant: `GetSecretStrAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.ListSecrets

`Chilkat 11.7.0 · tcl · Secrets · ListSecrets · method · since 10.1.0`

```tcl
# json is a CkJsonObject

# jsonOut is a CkJsonObject

set status [CkSecrets_ListSecrets $this $json  $jsonOut]
```

Lists secrets matching the wildcarded or exact values passed in `json`. The results of the query are returned in `jsonOut`.

Returns 1 for success, 0 for failure.

Async variant: `ListSecretsAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.SecretSpecToJson

`Chilkat 11.7.0 · tcl · Secrets · SecretSpecToJson · method · since 11.5.0`

```tcl
# secretSpec is a string

# json is a CkJsonObject

set status [CkSecrets_SecretSpecToJson $this $secretSpec  $json]
```

Converts a secret specification string (`secretSpec`) to JSON. A secret specification string is formatted as "!!part1\|part2\|part3\|part4" where parts 3 and 4 are optional. `json` is the output argument.

Returns 1 for success, 0 for failure.

### Secrets.SetBootstrapSecret

`Chilkat 11.7.0 · tcl · Secrets · SetBootstrapSecret · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# secretContent is a CkSecrets

set status [CkSecrets_SetBootstrapSecret $this $jsonId  $secretContent]
```

Accessing a cloud-based secrets manager requires authentication credentials, which cannot be stored in the manager itself. Instead, they must be securely stored locally.

One solution is to store the authentication credentials as a secret in the Windows Credentials Manager or Apple Keychain. These credentials serve as the `bootstrap secret` for authenticating with the cloud-based secrets manager.

`jsonId` contains the name of the bootstrap secret. `secretContent` contains the bootstrap's secret content.

Returns 1 for success, 0 for failure.

### Secrets.UpdateSecretBd

`Chilkat 11.7.0 · tcl · Secrets · UpdateSecretBd · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# secret is a CkBinData

set status [CkSecrets_UpdateSecretBd $this $jsonId  $secret]
```

Creates a binary secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the binary content of the secret in `secret`.

Returns 1 for success, 0 for failure.

Async variant: `UpdateSecretBdAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.UpdateSecretJson

`Chilkat 11.7.0 · tcl · Secrets · UpdateSecretJson · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# secret is a CkJsonObject

set status [CkSecrets_UpdateSecretJson $this $jsonId  $secret]
```

Creates a JSON secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the JSON content of the secret in `secret`.

Returns 1 for success, 0 for failure.

Async variant: `UpdateSecretJsonAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.UpdateSecretSb

`Chilkat 11.7.0 · tcl · Secrets · UpdateSecretSb · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# sb is a CkStringBuilder

set status [CkSecrets_UpdateSecretSb $this $jsonId  $sb]
```

Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the string content of the secret in `sb`.

Returns 1 for success, 0 for failure.

Async variant: `UpdateSecretSbAsync` — same arguments, returns a `Task` (see Async variants below).

### Secrets.UpdateSecretStr

`Chilkat 11.7.0 · tcl · Secrets · UpdateSecretStr · method · since 10.1.0`

```tcl
# jsonId is a CkJsonObject

# secret is a string

set status [CkSecrets_UpdateSecretStr $this $jsonId  $secret]
```

Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the string content of the secret in `secret`.

Note: Starting in Chilkat **v11.3.0**, if the `service` = `"Chilkat"` and the `username` = `"unlock_code"`, then the secret (which is the Chilkat unlock code) can be stored and retrieved without Chilkat being unlocked. This allows for the Chilkat unlock code itself to be persisted to a secrets manager.

Returns 1 for success, 0 for failure.

Async variant: `UpdateSecretStrAsync` — same arguments, returns a `Task` (see Async variants below).

## Events and callbacks

This binding has no event callbacks. For progress, percent-done or cancellation use the `*Async` variant of a method and poll the returned `Task` (`PercentDone`, `Finished`, `Cancel`).

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```tcl
# returns a CkTask

# jsonId is a CkJsonObject

set ret_task [CkSecrets_DeleteSecretAsync $this $jsonId]
# returns a CkTask

# jsonId is a CkJsonObject

# bd is a CkBinData

set ret_task [CkSecrets_GetSecretBdAsync $this $jsonId  $bd]
# returns a CkTask

# jsonId is a CkJsonObject

# jsonOut is a CkJsonObject

set ret_task [CkSecrets_GetSecretJsonAsync $this $jsonId  $jsonOut]
# returns a CkTask

# jsonId is a CkJsonObject

# sb is a CkStringBuilder

set ret_task [CkSecrets_GetSecretSbAsync $this $jsonId  $sb]
# returns a CkTask

# jsonId is a CkJsonObject

set ret_task [CkSecrets_GetSecretStrAsync $this $jsonId]
# returns a CkTask

# json is a CkJsonObject

# jsonOut is a CkJsonObject

set ret_task [CkSecrets_ListSecretsAsync $this $json  $jsonOut]
# returns a CkTask

# jsonId is a CkJsonObject

# secret is a CkBinData

set ret_task [CkSecrets_UpdateSecretBdAsync $this $jsonId  $secret]
# returns a CkTask

# jsonId is a CkJsonObject

# secret is a CkJsonObject

set ret_task [CkSecrets_UpdateSecretJsonAsync $this $jsonId  $secret]
# returns a CkTask

# jsonId is a CkJsonObject

# sb is a CkStringBuilder

set ret_task [CkSecrets_UpdateSecretSbAsync $this $jsonId  $sb]
# returns a CkTask

# jsonId is a CkJsonObject

# secret is a string

set ret_task [CkSecrets_UpdateSecretStrAsync $this $jsonId  $secret]
```

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/BinData.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/JsonObject.md), [`StringBuilder`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/StringBuilder.md)