Disabled Secrets

Disabling a secret hides it from consumption without deleting it. The secret keeps its value, history, and definition — it simply stops being injected into your apps until you re-enable it.

Use it to temporarily turn off a variable (e.g. a feature flag, a third-party integration you're pausing, or a credential you're rotating) without losing the value or having to re-create the secret later.

How it differs from delete and placeholders

	Disable	Delete	Placeholder
Value kept	Yes	No (soft-deleted)	No value to keep
Shows in dashboard	Yes (greyed, toggleable)	No	Yes
Included in consumption	No	No	No (key listed, awaits a personal override)
Reversible	Yes — enable	Restore from history/snapshot	Set an override
Intended use	Temporarily turn a variable off	Permanently remove a variable	Declare a key that each user fills in personally

A delete removes the secret. A placeholder is a key that has no shared value and expects each user to supply a personal override. A disabled secret has a real value that is intentionally withheld from consumption.

Consumer contract

When a secret is disabled, every consumption path (CLI pull/run and the REST API) omits its value but still lists its key so consumers know it exists and was intentionally hidden:

• The value never appears in secrets, the rendered .env, or the process environment.
• The key is reported in an additive disabled: string[] field on the collection API response (only emitted when non-empty). This mirrors how placeholders works.
• The CLI prints a dim N disabled secret(s) skipped line after pull and run.

// GET /api/v1/secrets/{org}/{project}/{env}
{
  "secrets": { "DATABASE_URL": "postgres://..." },
  "placeholders": [],
  "disabled": ["LEGACY_API_KEY"],   // hidden — key listed, no value
  "version": 42
}

Requesting a disabled secret directly returns 404 Not Found, the same as a key that does not exist.

Granularity: per-environment and bulk

Disabling is per-environment. Disabling LEGACY_API_KEY in production does not affect staging. To disable a key across environments, disable it in each one.

You can disable or enable secrets:

• One at a time — from the dashboard toggle or the CLI.
• In bulk — select multiple secrets in the dashboard and disable/enable them together.

References to a disabled secret resolve as missing

If another secret references a disabled secret with ${KEY} (or ${env.KEY}), the reference resolves as missing — the token is left literal and surfaced in referenceErrors. A disabled secret is treated as absent for reference resolution, exactly as if it did not exist.

CLI

# Disable a secret in the current environment (prompts for confirmation)
envshed secret disable LEGACY_API_KEY

# Skip the confirmation prompt
envshed secret disable LEGACY_API_KEY --yes

# Re-enable it
envshed secret enable LEGACY_API_KEY

# Target a specific environment
envshed secret disable LEGACY_API_KEY -e production

See envshed secret for the full option reference.