Skip to content
Kitsy Docs Open CNOS
Kitsy Docs

cnos secret

cnos secret

Terminal window
cnos secret set app.token super-secret --vault default
cnos secret set app.token --vault default
printf "super-secret" | cnos secret set app.token --vault default --stdin
cnos secret set app.token --vault prod-gcp
cnos secret get app.token --vault default --reveal
cnos secret list
cnos secret list --reveal
cnos secret delete app.token

For local vaults, omitting [value] prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use --stdin.

For non-local vaults such as environment, gcp-secret-manager, aws-secrets-manager, hashicorp-vault, and azure-key-vault, cnos secret set writes repo-safe reference metadata only. If [value] is omitted, CNOS uses the logical path as the external ref and does not prompt for secret material. Create or update the actual secret in the backing vault separately.