hart secret

Secrets live in the workspace's vault, encrypted, and reach services as ${{ secrets.NAME }} at the next hart sync. Values are never shown, not even to you.

hart secret [flags]
hart secret [command]

Subcommands:

• hart secret delete: Delete a secret with all its revisions
• hart secret generate: Store a new random value for a key
• hart secret keys: List the keys and their revisions
• hart secret set: Set a secret's value

hart secret deleteCopy Anchor Link

Services that reference the key fail their next Sync until it has a value again.

hart secret delete KEY [flags]

Aliases: delete, unset, rm.

hart secret generateCopy Anchor Link

Stores a new revision with a random value (letters and digits, at least one of each kind; --symbols adds punctuation). The value is not shown: services read it as ${{ secrets.KEY }}.

hart secret generate KEY [flags]

hart secret keysCopy Anchor Link

List the keys and their revisions

hart secret keys [flags]

hart secret setCopy Anchor Link

Stores a new revision of the key. The value is read without echo from the terminal, or from stdin when it is piped (one trailing newline is dropped). It is never taken from the command line, where it would end up in the shell history and the process list.

hart secret set KEY [flags]

Examples:

hart secret set DB_PASSWORD
op read op://vault/db/password | hart secret set DB_PASSWORD