# RadiusSecretStoreConsumerExtensions Methods

- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Type: [RadiusSecretStoreConsumerExtensions](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreconsumerextensions.md)
- Kind: `Methods`
- Members: `3`

Fluent entry points for consuming a declared Radius secret store from its documented Radius consumers (environment `recipeConfig` authentication / `envSecrets`). Each reference is emitted by the store's fully-qualified UCP secret-store ID ( `/planes/radius/local/resourceGroups/<group>/providers/Applications.Core/secretStores/<name>`). All surface is experimental and gated by `ASPIRERADIUS006`.

<a id="withbicepregistryauthentication"></a>
<a id="withbicepregistryauthentication-iresourcebuilder-radiusenvironmentresource-string-iresourcebuilder-radiussecretstoreresource"></a>

## WithBicepRegistryAuthentication(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithBicepRegistryAuthentication(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusEnvironmentResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreConsumerExtensions.cs#L34)

Uses a `basicAuthentication` store as private Bicep-registry auth in `recipeConfig`.

```csharp
public static class RadiusSecretStoreConsumerExtensions
{
    public static IResourceBuilder<RadiusEnvironmentResource> WithBicepRegistryAuthentication(
        this IResourceBuilder<RadiusEnvironmentResource> radius,
        string registryHost,
        IResourceBuilder<RadiusSecretStoreResource> store)
    {
        // ...
    }
}
```

## Parameters

- `radius` (`IResourceBuilder<RadiusEnvironmentResource>`)
  The Radius environment builder.
- `registryHost` (`string`)
  The container-registry host the credentials authenticate against (e.g. `myregistry.azurecr.io`).
- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The `basicAuthentication` secret store supplying the registry credentials.

## Returns

`IResourceBuilder<RadiusEnvironmentResource>` -- The same environment builder for chaining.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store consumer surface; there is no polyglot ATS equivalent yet.

<a id="withrecipeenvironmentsecret"></a>
<a id="withrecipeenvironmentsecret-iresourcebuilder-radiusenvironmentresource-string-iresourcebuilder-radiussecretstoreresource-string"></a>

## WithRecipeEnvironmentSecret(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>, string)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithRecipeEnvironmentSecret(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>, string)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusEnvironmentResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreConsumerExtensions.cs#L64-L65)

Adds a `recipeConfig.envSecrets['<VAR>'] = { source: <storeId>, key: <k> }` entry.

```csharp
public static class RadiusSecretStoreConsumerExtensions
{
    public static IResourceBuilder<RadiusEnvironmentResource> WithRecipeEnvironmentSecret(
        this IResourceBuilder<RadiusEnvironmentResource> radius,
        string variableName,
        IResourceBuilder<RadiusSecretStoreResource> store,
        string key)
    {
        // ...
    }
}
```

## Parameters

- `radius` (`IResourceBuilder<RadiusEnvironmentResource>`)
  The Radius environment builder.
- `variableName` (`string`)
  The recipe environment-variable name the secret is exposed as.
- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret store supplying the value.
- `key` (`string`)
  The key within `store` to read. Must be a key the store declares.

## Returns

`IResourceBuilder<RadiusEnvironmentResource>` -- The same environment builder for chaining.

## Exceptions

- `ArgumentException` -- `key` is empty or whitespace.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store consumer surface; there is no polyglot ATS equivalent yet.

<a id="withterraformgitauthentication"></a>
<a id="withterraformgitauthentication-iresourcebuilder-radiusenvironmentresource-string-iresourcebuilder-radiussecretstoreresource"></a>

## WithTerraformGitAuthentication(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithTerraformGitAuthentication(IResourceBuilder<RadiusEnvironmentResource>, string, IResourceBuilder<RadiusSecretStoreResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusEnvironmentResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreConsumerExtensions.cs#L47)

Uses a store exposing a `pat` key (optionally `username`) as a Terraform Git PAT in `recipeConfig`.

```csharp
public static class RadiusSecretStoreConsumerExtensions
{
    public static IResourceBuilder<RadiusEnvironmentResource> WithTerraformGitAuthentication(
        this IResourceBuilder<RadiusEnvironmentResource> radius,
        string gitHost,
        IResourceBuilder<RadiusSecretStoreResource> store)
    {
        // ...
    }
}
```

## Parameters

- `radius` (`IResourceBuilder<RadiusEnvironmentResource>`)
  The Radius environment builder.
- `gitHost` (`string`)
  The Git host the PAT authenticates against (e.g. `github.com`).
- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret store supplying the Git PAT; it must declare a `pat` key (typically a `generic` store).

## Returns

`IResourceBuilder<RadiusEnvironmentResource>` -- The same environment builder for chaining.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store consumer surface; there is no polyglot ATS equivalent yet.