envshed secret
Manage individual secrets by key.
secret get
envshed secret get <KEY> [options]
Fetches the decrypted value for a single secret. When stdout is a terminal (TTY), a warning is printed to stderr:
Tip: pipe to clipboard or file to avoid terminal history exposure
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
--output json | Print JSON output |
secret set
envshed secret set <KEY> [options]
Sets or creates a secret. The value is never accepted as a positional argument or --value flag to prevent shell history exposure. Instead:
- When stdin is a TTY, you are prompted interactively with a masked input.
- When stdin is piped, the value is read from stdin (30-second timeout).
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
--placeholder | Mark the secret as a placeholder (no value required) |
--output json | Print JSON output |
secret delete
envshed secret delete <KEY> [options]
Deletes a secret. Prompts for confirmation unless --yes is passed.
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
-y, --yes | Skip confirmation prompt |
--output json | Print JSON output |
secret disable
envshed secret disable <KEY> [options]
Disables a secret in the given environment. A disabled secret is hidden from consumption — its value is omitted from pull, run, and the REST API — but it is not deleted. The key still appears (greyed out) in the dashboard and can be re-enabled at any time. Prompts for confirmation unless --yes is passed.
Disable is per-environment. To disable the same key elsewhere, run the command against each environment.
See Disabled Secrets for the full behavior.
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
-y, --yes | Skip confirmation prompt |
--output json | Print JSON output |
secret enable
envshed secret enable <KEY> [options]
Re-enables a previously disabled secret in the given environment. The secret resumes being included in consumption immediately.
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
--output json | Print JSON output |
secret override set
envshed secret override set <KEY> [options]
Sets a personal override for a secret. Your override is visible only to you and takes effect when you pull or run the environment. Uses the same masked prompt / stdin pipe pattern as secret set.
This command requires a user token. Service tokens cannot set personal overrides.
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
--output json | Print JSON output |
secret override remove
envshed secret override remove <KEY> [options]
Removes your personal override for a secret. Prompts for confirmation unless --yes is passed.
This command requires a user token. Service tokens cannot remove personal overrides.
Options
| Option | Description |
|---|---|
-o, --org <slug> | Organization slug |
-p, --project <slug> | Project slug |
-e, --env <slug> | Environment slug |
-y, --yes | Skip confirmation prompt |
--output json | Print JSON output |