Secret Commands

Commands for managing secrets within a project.

pull

Pull secrets from the server to a local .env file.

keyenv pull [OPTIONS]

Options

Option	Description
`-e, --env <ENV>`	Environment to pull from (default: development)
`-f, --force`	Overwrite existing file without confirmation

Examples

# Pull development secrets to .env
keyenv pull

# Pull production secrets to .env
keyenv pull -e production

# Pull staging secrets, overwrite existing
keyenv pull -e staging --force

push

Push local secrets from a .env file to the server.

keyenv push [OPTIONS]

Options

Option	Description
`-e, --env <ENV>`	Environment to push to (default: development)
`-f, --force`	Overwrite existing secrets

Examples

# Push .env to development
keyenv push

# Force overwrite existing secrets
keyenv push --force

Behavior

Without --force:

New secrets are created
Existing secrets are skipped
You'll see a summary: "Created: 5, Skipped: 3"

With --force:

New secrets are created
Existing secrets are updated
You'll see: "Created: 2, Updated: 6"

list

List all secrets in the current project (keys only, values hidden).

keyenv list [OPTIONS]

Options

Option	Description
`-e, --env <ENV>`	Environment (default: development)

Examples

keyenv list

# Secrets (development):
#   • DATABASE_URL (v3)
#   • STRIPE_KEY (v1)
#   • API_SECRET (v2)
#
# 3 secrets

JSON Output

keyenv list --json

{
  "environment": "development",
  "secrets": [
    { "key": "DATABASE_URL", "version": 3 },
    { "key": "STRIPE_KEY", "version": 1 }
  ],
  "count": 2
}

get

Get a specific secret value.

keyenv get <KEY> [OPTIONS]

Arguments

Argument	Description
`KEY`	The secret key to retrieve

Options

Option	Description
`-e, --env <ENV>`	Environment (default: development)

Examples

# Get a secret value
keyenv get DATABASE_URL

# Get from production
keyenv get DATABASE_URL -e production

# Use in scripts
export DB=$(keyenv get DATABASE_URL -q)

set

Set a secret value (creates or updates).

keyenv set <KEY> <VALUE> [OPTIONS]

Arguments

Argument	Description
`KEY`	The secret key
`VALUE`	The secret value (use `-` to read from stdin)

Options

Option	Description
`-e, --env <ENV>`	Environment (default: development)
`-g, --generate <TYPE>`	Generate a random secret value (type: password, uuid, hex, base64, alphanumeric)
`-l, --length <N>`	Length of generated secret in characters (default: 32, requires --generate)

Examples

# Set a secret
keyenv set DATABASE_URL "postgres://localhost/mydb"

# Set in production
keyenv set API_KEY "sk_live_..." -e production

# Read from stdin (for sensitive values)
echo "super-secret" | keyenv set MY_SECRET -

# Pipe from a command
op read "op://vault/item/password" | keyenv set PASSWORD -

# Generate a random password
keyenv set API_SECRET --generate password

# Generate a UUID
keyenv set REQUEST_ID --generate uuid

# Generate a 64-character hex secret
keyenv set ENCRYPTION_KEY --generate hex --length 64

delete

Delete a secret.

keyenv delete <KEY> [OPTIONS]

Arguments

Argument	Description
`KEY`	The secret key to delete

Options

Option	Description
`-e, --env <ENV>`	Environment (default: development)
`-y, --yes`	Skip confirmation prompt

Examples

# Delete with confirmation
keyenv delete OLD_API_KEY

# Delete without confirmation
keyenv delete OLD_API_KEY --yes

# Delete from production
keyenv delete DEPRECATED_KEY -e production -y

Deletion is permanent. Consider using version history before deleting if you might need the value later.

Secret Commands

On this page