Configuration
Secrets
In order to persist secrets between DuckDB database instances, we can now use the `CREATE PERSISTENT SECRET` command, e.g.:  
```sql
CREATE PERSISTENT SECRET my_persistent_secret (
TYPE S3,
KEY_ID 'my_secret_key',
SECRET 'my_secret_value'
);
```  
By default, this will write the secret (unencrypted) to the `~/.duckdb/stored_secrets` directory. To change the secrets directory, issue:  
```sql
SET secret_directory = 'path/to/my_secrets_dir';
```  
Note that setting the value of the `home_directory` configuration option has no effect on the location of the secrets.  
#### Deleting Secrets {#docs:configuration:secrets_manager::deleting-secrets}  
Secrets can be deleted using the [`DROP SECRET` statement](#docs:sql:statements:create_secret::syntax-for-drop-secret), e.g.:  
```sql
DROP PERSISTENT SECRET my_persistent_secret;
```  
#### Creating Multiple Secrets for the Same Service Type {#docs:configuration:secrets_manager::creating-multiple-secrets-for-the-same-service-type}  
If two secrets exist for a service type, the scope can be used to decide which one should be used. For example:  
```sql
CREATE SECRET secret1 (
TYPE S3,
KEY_ID 'my_secret_key1',
SECRET 'my_secret_value1',
SCOPE 's3://my-bucket'
);
```  
```sql
CREATE SECRET secret2 (
TYPE S3,
KEY_ID 'my_secret_key2',
SECRET 'my_secret_value2',
SCOPE 's3://my-other-bucket'
);
```  
Now, if the user queries something from `s3://my-other-bucket/something`, secret `secret2` will be chosen automatically for that request. To see which secret is being used, the `which_secret` scalar function can be used, which takes a path and a secret type as parameters:  
```sql
FROM which_secret('s3://my-other-bucket/file.parquet', 's3');
```  
#### Listing Secrets {#docs:configuration:secrets_manager::listing-secrets}  
Secrets can be listed using the built-in table-producing function, e.g., by using the [`duckdb_secrets()` table function](#docs:sql:meta:duckdb_table_functions::duckdb_secrets):  
```sql
FROM duckdb_secrets();
```  
Sensitive information will be redacted.