diff --git a/cli/secret/secret.go b/cli/secret/secret.go
index 3a8801f59..186a466b4 100644
--- a/cli/secret/secret.go
+++ b/cli/secret/secret.go
@@ -1,9 +1,12 @@
 package secret
 
 import (
+	"strings"
+
 	"github.com/urfave/cli/v2"
 
 	"github.com/woodpecker-ci/woodpecker/cli/common"
+	"github.com/woodpecker-ci/woodpecker/cli/internal"
 )
 
 // Command exports the secret command.
@@ -19,3 +22,25 @@ var Command = &cli.Command{
 		secretListCmd,
 	},
 }
+
+func parseTargetArgs(c *cli.Context) (global bool, owner, name string, err error) {
+	if c.Bool("global") {
+		return true, "", "", nil
+	}
+	orgName := c.String("organization")
+	repoName := c.String("repository")
+	if orgName == "" && repoName == "" {
+		repoName = c.Args().First()
+	}
+	if orgName == "" && !strings.Contains(repoName, "/") {
+		orgName = repoName
+	}
+	if orgName != "" {
+		return false, orgName, "", err
+	}
+	owner, name, err = internal.ParseRepo(repoName)
+	if err != nil {
+		return false, "", "", err
+	}
+	return false, owner, name, nil
+}
diff --git a/cli/secret/secret_add.go b/cli/secret/secret_add.go
index bed42d63e..2a368fcf3 100644
--- a/cli/secret/secret_add.go
+++ b/cli/secret/secret_add.go
@@ -1,7 +1,7 @@
 package secret
 
 import (
-	"io/ioutil"
+	"os"
 	"strings"
 
 	"github.com/urfave/cli/v2"
@@ -14,9 +14,17 @@ import (
 var secretCreateCmd = &cli.Command{
 	Name:      "add",
 	Usage:     "adds a secret",
-	ArgsUsage: "[repo/name]",
+	ArgsUsage: "[org/repo|org]",
 	Action:    secretCreate,
 	Flags: append(common.GlobalFlags,
+		&cli.BoolFlag{
+			Name:  "global",
+			Usage: "global secret",
+		},
+		&cli.StringFlag{
+			Name:  "organization",
+			Usage: "organization name (e.g. octocat)",
+		},
 		&cli.StringFlag{
 			Name:  "repository",
 			Usage: "repository name (e.g. octocat/hello-world)",
@@ -41,14 +49,6 @@ var secretCreateCmd = &cli.Command{
 }
 
 func secretCreate(c *cli.Context) error {
-	reponame := c.String("repository")
-	if reponame == "" {
-		reponame = c.Args().First()
-	}
-	owner, name, err := internal.ParseRepo(reponame)
-	if err != nil {
-		return err
-	}
 	client, err := internal.NewClient(c)
 	if err != nil {
 		return err
@@ -64,13 +64,27 @@ func secretCreate(c *cli.Context) error {
 	}
 	if strings.HasPrefix(secret.Value, "@") {
 		path := strings.TrimPrefix(secret.Value, "@")
-		out, ferr := ioutil.ReadFile(path)
-		if ferr != nil {
-			return ferr
+		out, err := os.ReadFile(path)
+		if err != nil {
+			return err
 		}
 		secret.Value = string(out)
 	}
-	_, err = client.SecretCreate(owner, name, secret)
+
+	global, owner, repo, err := parseTargetArgs(c)
+	if err != nil {
+		return err
+	}
+
+	if global {
+		_, err = client.GlobalSecretCreate(secret)
+		return err
+	}
+	if repo == "" {
+		_, err = client.OrgSecretCreate(owner, secret)
+		return err
+	}
+	_, err = client.SecretCreate(owner, repo, secret)
 	return err
 }
 
diff --git a/cli/secret/secret_info.go b/cli/secret/secret_info.go
index 2e8a7a678..c4fe2969b 100644
--- a/cli/secret/secret_info.go
+++ b/cli/secret/secret_info.go
@@ -8,14 +8,23 @@ import (
 
 	"github.com/woodpecker-ci/woodpecker/cli/common"
 	"github.com/woodpecker-ci/woodpecker/cli/internal"
+	"github.com/woodpecker-ci/woodpecker/woodpecker-go/woodpecker"
 )
 
 var secretInfoCmd = &cli.Command{
 	Name:      "info",
 	Usage:     "display secret info",
-	ArgsUsage: "[repo/name]",
+	ArgsUsage: "[org/repo|org]",
 	Action:    secretInfo,
 	Flags: append(common.GlobalFlags,
+		&cli.BoolFlag{
+			Name:  "global",
+			Usage: "global secret",
+		},
+		&cli.StringFlag{
+			Name:  "organization",
+			Usage: "organization name (e.g. octocat)",
+		},
 		&cli.StringFlag{
 			Name:  "repository",
 			Usage: "repository name (e.g. octocat/hello-world)",
@@ -31,24 +40,36 @@ var secretInfoCmd = &cli.Command{
 func secretInfo(c *cli.Context) error {
 	var (
 		secretName = c.String("name")
-		repoName   = c.String("repository")
 		format     = c.String("format") + "\n"
 	)
-	if repoName == "" {
-		repoName = c.Args().First()
-	}
-	owner, name, err := internal.ParseRepo(repoName)
-	if err != nil {
-		return err
-	}
 	client, err := internal.NewClient(c)
 	if err != nil {
 		return err
 	}
-	secret, err := client.Secret(owner, name, secretName)
+
+	global, owner, repo, err := parseTargetArgs(c)
 	if err != nil {
 		return err
 	}
+
+	var secret *woodpecker.Secret
+	if global {
+		secret, err = client.GlobalSecret(secretName)
+		if err != nil {
+			return err
+		}
+	} else if repo == "" {
+		secret, err = client.OrgSecret(owner, secretName)
+		if err != nil {
+			return err
+		}
+	} else {
+		secret, err = client.Secret(owner, repo, secretName)
+		if err != nil {
+			return err
+		}
+	}
+
 	tmpl, err := template.New("_").Funcs(secretFuncMap).Parse(format)
 	if err != nil {
 		return err
diff --git a/cli/secret/secret_list.go b/cli/secret/secret_list.go
index fabd8e7f3..a2f43efd2 100644
--- a/cli/secret/secret_list.go
+++ b/cli/secret/secret_list.go
@@ -9,14 +9,23 @@ import (
 
 	"github.com/woodpecker-ci/woodpecker/cli/common"
 	"github.com/woodpecker-ci/woodpecker/cli/internal"
+	"github.com/woodpecker-ci/woodpecker/woodpecker-go/woodpecker"
 )
 
 var secretListCmd = &cli.Command{
 	Name:      "ls",
 	Usage:     "list secrets",
-	ArgsUsage: "[repo/name]",
+	ArgsUsage: "[org/name|org]",
 	Action:    secretList,
 	Flags: append(common.GlobalFlags,
+		&cli.BoolFlag{
+			Name:  "global",
+			Usage: "global secret",
+		},
+		&cli.StringFlag{
+			Name:  "organization",
+			Usage: "organization name (e.g. octocat)",
+		},
 		&cli.StringFlag{
 			Name:  "repository",
 			Usage: "repository name (e.g. octocat/hello-world)",
@@ -26,25 +35,36 @@ var secretListCmd = &cli.Command{
 }
 
 func secretList(c *cli.Context) error {
-	var (
-		format   = c.String("format") + "\n"
-		reponame = c.String("repository")
-	)
-	if reponame == "" {
-		reponame = c.Args().First()
-	}
-	owner, name, err := internal.ParseRepo(reponame)
-	if err != nil {
-		return err
-	}
+	format := c.String("format") + "\n"
+
 	client, err := internal.NewClient(c)
 	if err != nil {
 		return err
 	}
-	list, err := client.SecretList(owner, name)
+
+	global, owner, repo, err := parseTargetArgs(c)
 	if err != nil {
 		return err
 	}
+
+	var list []*woodpecker.Secret
+	if global {
+		list, err = client.GlobalSecretList()
+		if err != nil {
+			return err
+		}
+	} else if repo == "" {
+		list, err = client.OrgSecretList(owner)
+		if err != nil {
+			return err
+		}
+	} else {
+		list, err = client.SecretList(owner, repo)
+		if err != nil {
+			return err
+		}
+	}
+
 	tmpl, err := template.New("_").Funcs(secretFuncMap).Parse(format)
 	if err != nil {
 		return err
diff --git a/cli/secret/secret_rm.go b/cli/secret/secret_rm.go
index 8441fef32..f0046e3bd 100644
--- a/cli/secret/secret_rm.go
+++ b/cli/secret/secret_rm.go
@@ -10,9 +10,17 @@ import (
 var secretDeleteCmd = &cli.Command{
 	Name:      "rm",
 	Usage:     "remove a secret",
-	ArgsUsage: "[repo/name]",
+	ArgsUsage: "[org/repo|org]",
 	Action:    secretDelete,
 	Flags: append(common.GlobalFlags,
+		&cli.BoolFlag{
+			Name:  "global",
+			Usage: "global secret",
+		},
+		&cli.StringFlag{
+			Name:  "organization",
+			Usage: "organization name (e.g. octocat)",
+		},
 		&cli.StringFlag{
 			Name:  "repository",
 			Usage: "repository name (e.g. octocat/hello-world)",
@@ -25,20 +33,23 @@ var secretDeleteCmd = &cli.Command{
 }
 
 func secretDelete(c *cli.Context) error {
-	var (
-		secret   = c.String("name")
-		reponame = c.String("repository")
-	)
-	if reponame == "" {
-		reponame = c.Args().First()
-	}
-	owner, name, err := internal.ParseRepo(reponame)
-	if err != nil {
-		return err
-	}
+	secretName := c.String("name")
+
 	client, err := internal.NewClient(c)
 	if err != nil {
 		return err
 	}
-	return client.SecretDelete(owner, name, secret)
+
+	global, owner, repo, err := parseTargetArgs(c)
+	if err != nil {
+		return err
+	}
+
+	if global {
+		return client.GlobalSecretDelete(secretName)
+	}
+	if repo == "" {
+		return client.OrgSecretDelete(owner, secretName)
+	}
+	return client.SecretDelete(owner, repo, secretName)
 }
diff --git a/cli/secret/secret_set.go b/cli/secret/secret_set.go
index 5ea3f030a..880a0c634 100644
--- a/cli/secret/secret_set.go
+++ b/cli/secret/secret_set.go
@@ -1,7 +1,7 @@
 package secret
 
 import (
-	"io/ioutil"
+	"os"
 	"strings"
 
 	"github.com/urfave/cli/v2"
@@ -14,9 +14,17 @@ import (
 var secretUpdateCmd = &cli.Command{
 	Name:      "update",
 	Usage:     "update a secret",
-	ArgsUsage: "[repo/name]",
+	ArgsUsage: "[org/repo|org]",
 	Action:    secretUpdate,
 	Flags: append(common.GlobalFlags,
+		&cli.BoolFlag{
+			Name:  "global",
+			Usage: "global secret",
+		},
+		&cli.StringFlag{
+			Name:  "organization",
+			Usage: "organization name (e.g. octocat)",
+		},
 		&cli.StringFlag{
 			Name:  "repository",
 			Usage: "repository name (e.g. octocat/hello-world)",
@@ -41,14 +49,6 @@ var secretUpdateCmd = &cli.Command{
 }
 
 func secretUpdate(c *cli.Context) error {
-	reponame := c.String("repository")
-	if reponame == "" {
-		reponame = c.Args().First()
-	}
-	owner, name, err := internal.ParseRepo(reponame)
-	if err != nil {
-		return err
-	}
 	client, err := internal.NewClient(c)
 	if err != nil {
 		return err
@@ -61,12 +61,26 @@ func secretUpdate(c *cli.Context) error {
 	}
 	if strings.HasPrefix(secret.Value, "@") {
 		path := strings.TrimPrefix(secret.Value, "@")
-		out, ferr := ioutil.ReadFile(path)
-		if ferr != nil {
-			return ferr
+		out, err := os.ReadFile(path)
+		if err != nil {
+			return err
 		}
 		secret.Value = string(out)
 	}
-	_, err = client.SecretUpdate(owner, name, secret)
+
+	global, owner, repo, err := parseTargetArgs(c)
+	if err != nil {
+		return err
+	}
+
+	if global {
+		_, err = client.GlobalSecretUpdate(secret)
+		return err
+	}
+	if repo == "" {
+		_, err = client.OrgSecretUpdate(owner, secret)
+		return err
+	}
+	_, err = client.SecretUpdate(owner, repo, secret)
 	return err
 }
diff --git a/docs/docs/40-cli.md b/docs/docs/40-cli.md
index 66cb76fd3..f024e3abc 100644
--- a/docs/docs/40-cli.md
+++ b/docs/docs/40-cli.md
@@ -478,6 +478,10 @@ adds a secret
 
 **--name**="": secret name
 
+**--global**: global secret
+
+**--organization**="": organization name (e.g. octocat)
+
 **--repository**="": repository name (e.g. octocat/hello-world)
 
 **--server, -s**="": server address
@@ -494,6 +498,10 @@ remove a secret
 
 **--name**="": secret name
 
+**--global**: global secret
+
+**--organization**="": organization name (e.g. octocat)
+
 **--repository**="": repository name (e.g. octocat/hello-world)
 
 **--server, -s**="": server address
@@ -512,6 +520,10 @@ update a secret
 
 **--name**="": secret name
 
+**--global**: global secret
+
+**--organization**="": organization name (e.g. octocat)
+
 **--repository**="": repository name (e.g. octocat/hello-world)
 
 **--server, -s**="": server address
@@ -528,6 +540,10 @@ display secret info
 
 **--name**="": secret name
 
+**--global**: global secret
+
+**--organization**="": organization name (e.g. octocat)
+
 **--repository**="": repository name (e.g. octocat/hello-world)
 
 **--server, -s**="": server address
@@ -540,6 +556,10 @@ list secrets
 
 **--log-level**="": set logging level (default: info)
 
+**--global**: global secret
+
+**--organization**="": organization name (e.g. octocat)
+
 **--repository**="": repository name (e.g. octocat/hello-world)
 
 **--server, -s**="": server address