Skip to main content
Your contract reads the API key from z:<tid>:secrets at runtime. There’s no set-credentials function — the tenant SDK writes the key straight into the map with the map-entry-set control call, on the authenticated tee:tenant/contracts path (not an agent call).
What happens:
  1. map-entry-set writes the value into z:<tid>:secrets. It is a control-plane write, so it bypasses the map’s writers ACL — the key lands even though the map is read/write-restricted to the contract alone (see Create tenant KV maps).
  2. At call time your contract reads it back with kv_store::get(&format!("z:{}:secrets", hex::encode(&tenant_did())), b"duffel_api_key") inside the TDX enclave — kv-store::get takes the full canonical map name (not the bare tail) and a byte-string key.
The only path to the key is through your contract code — no external observer, not the agent, not the calling developer, can read it back out.