Single secrets
Set one secret#
envpilot secrets set # guided: key → masked value → sensitive?
envpilot secrets set STRIPE_SECRET_KEY -e production # key given, value prompted masked
envpilot secrets set API_URL=https://api.example.com # inline — CI onlyTwo-step by default: the key is validated first, then the value is typed into a masked prompt, so it never reaches your shell history or ps output. The inline KEY=VALUE form exists for CI and prints a history warning when you use it interactively.
envpilot var … is an alias for the same command.
Options — -e, --env <environment> · -p, --project <name-or-id> · -d, --description <text> · --sensitive · --all-envs
Behaviour worth knowing:
- Role-aware. If your role cannot write directly, the same flow files a variable request instead of rejecting you.
- Shared values need consent. A value shared across several environments lives on one variable, so updating it changes all of them — the CLI asks first, and
--all-envsanswers non-interactively. - Plan limits are enforced server-side and reported readably;
envpilot usageshows where you stand.
Protected environments#
If the target environment is marked protected (Settings → Protection),
secrets set doesn't fail or need a flag — it automatically files a change
request instead of writing, and prints the request id. secrets rm asks
first (production is protected. File a change request to delete it?);
answer no and nothing changes. Non-interactively, without --yes, it fails
with the same message and a hint to re-run with --yes. Either way a second
person with the approve capability has to accept the request before the
variable actually changes.
Delete one secret#
envpilot secrets rm OLD_FLAG
envpilot secrets rm OLD_FLAG -e staging --yesWhat happens depends on how widely the key is scoped:
| Situation | Result |
|---|---|
| Key exists only in the selected environment | Moved to trash — recoverable from the dashboard for 7 days |
| Key shared across environments | Only this environment is detached; the value stays live in the others |
Limits#
secrets setwrites one key in one environment per invocation. For bulk work usepush.secrets rmnever bypasses the trash: recovery is via the dashboard, not the CLI.--valueinline forms land in shell history. Prefer the masked prompt; in CI prefer stdin, see CLI in CI.