# RadiusSecretStoreExtensions

- Kind: `class`
- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Version: `13.6.0-preview.1.26478.8`
- Namespace: `Aspire.Hosting`
- Target framework: `net10.0`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs)

Builder entry points for declaring and populating Radius secret stores ( `Applications.Core/secretStores`). All surface is experimental and gated by `ASPIRERADIUS006`.

## Definition

```csharp
namespace Aspire.Hosting;

public static class RadiusSecretStoreExtensions
{
    // ...
}
```

## Methods

- [AddRadiusSecretStore(IDistributedApplicationBuilder, string, RadiusSecretStoreType)](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#addradiussecretstore-idistributedapplicationbuilder-string-radiussecretstoretype) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- Declares an application-scoped Radius secret store ( `properties.application`). Choose the population mode with exactly one of `WithData` / `WithExistingSecret` / `WithSealedSecret`.
- [WithData(IResourceBuilder<RadiusSecretStoreResource>, Action<RadiusSecretStoreDataBuilder>)](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withdata-iresourcebuilder-radiussecretstoreresource-action-radiussecretstoredatabuilder) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- Populates the store inline (Radius-created) from Aspire secret parameters. Each key's value is emitted as a valueless `@secure()` Bicep `param` and supplied at deploy time via `rad deploy --parameters`.
- [WithData(IResourceBuilder<RadiusSecretStoreResource>, string, IResourceBuilder<ParameterResource>, RadiusSecretStoreEncoding?)](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withdata-iresourcebuilder-radiussecretstoreresource-string-iresourcebuilder-parameterresource-radiussecretstoreencoding) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- Populates the store inline (Radius-created) by binding a single data `key` to a secret parameter. This is a convenience over the callback overload for the common single-key case; the value is emitted as a valueless `@secure()` Bicep `param` and supplied at deploy time via `rad deploy --parameters`. Like the other population methods this may be called at most once per store (a second population call throws `ASPIRERADIUS065`); use the callback overload to bind multiple keys.
- [WithExistingSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withexistingsecret-iresourcebuilder-radiussecretstoreresource-string-string) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- References an existing cluster `Secret` by `<namespace>/<name>` (or a bare `<name>`, whose namespace defaults to the owning environment's). No secret value flows through Aspire.
- [WithMaterializationTimeout(IResourceBuilder<RadiusSecretStoreResource>, TimeSpan)](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withmaterializationtimeout-iresourcebuilder-radiussecretstoreresource-timespan) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- Overrides the per-store timeout for awaiting a sealed `Secret` to materialize in-cluster before `rad deploy` (default 120 seconds). The timeout bounds the whole apply→sync-poll→key-verify sequence as a single shared budget, so a stalled `kubectl apply` or verify call is cancelled with `ASPIRERADIUS066` once it is exhausted. This only affects the sealed-secret deploy path ( `WithSealedSecret`). Calling it on a store that is not populated with `WithSealedSecret` is rejected by the validation gate with `ASPIRERADIUS062` rather than silently ignored.
- [WithSealedSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withsealedsecret-iresourcebuilder-radiussecretstoreresource-string-string) : `IResourceBuilder<RadiusSecretStoreResource>` `extension` `experimental` `ats ignored` -- References the decrypted `Secret` of a committed, encrypted Bitnami `SealedSecret` manifest. At publish the manifest is copied alongside the owning group's `app.bicep`; at deploy it is applied and awaited before `rad deploy`. The integration never seals plaintext.
- [WithSecretStore(IResourceBuilder<RadiusEnvironmentResource>, string, RadiusSecretStoreType, Action<IResourceBuilder<RadiusSecretStoreResource>>)](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions/methods.md#withsecretstore-iresourcebuilder-radiusenvironmentresource-string-radiussecretstoretype-action-iresourcebuilder-radiussecretstoreresource) : `IResourceBuilder<RadiusEnvironmentResource>` `extension` `experimental` `ats ignored` -- Declares an environment-scoped Radius secret store ( `properties.environment`) on `radius` and configures it.