ak secrets set

Use ak secrets set for the operation described below. The command help records its arguments, effects, and options.

Store a value under <ref> in the active secrets backend. The value is read from --value=- (stdin), --value-file=<path>, or an interactive, non-echoing prompt — never from --value=<literal> on the command line, which would leak the value into shell history and process listings (ps, /proc). The active backend sets no size limit per value. Use it before the first run that needs ${REF}, or with --force to overwrite an existing value.

Effects: Writes the value to the active backend and creates or updates the ref's metadata (never a value) in ~/.agentkit/secrets/index.json. --rotate-ttl records this ref's rotation window there; omitting it leaves a window already stored unchanged, so an ordinary rotation never resets one an operator shortened.

Exit status: 0 success 2 invalid flags or arguments 4 ref already exists and --force was not passed 5 backend or index failure

ak secrets set <ref> [flags]

Examples

  ak secrets set ${REF}                                  # interactive, non-echoing prompt
  echo -n "${VALUE}" | ak secrets set ${REF} --value=-  # pipe from stdin
  ak secrets set ${REF} --value-file ${PATH}             # read from a file
  ak secrets set ${REF} --force --rotate-ttl 30d         # overwrite, then remind to rotate every 30 days

Options

      --backend string         Storage backend: keychain (default), file (age-encrypted vault), or memory (dev/test; values and its index are throwaway)
      --force                  Overwrite an existing value instead of failing
  -h, --help                   help for set
      --json                   Emit machine-readable JSON (implies --no-interactive)
      --no-interactive         Disable interactive prompts (CI-safe)
  -q, --quiet                  Suppress non-error output on stderr
      --rotate-ttl string      How long this secret may go between rotations, in whole days, e.g. 30d, 2w, or 45 (default 90d)
      --unlock-with-recovery   Open the file backend's vault with a recovery private key and set a new passphrase
      --value string           Secret value source: '-' reads from stdin. A literal value is rejected — use --value=- or --value-file
      --value-file string      Path to a file containing the secret value
  -V, --verbose                Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes                    Assume yes for all prompts

Command contract

Synopsis

Examples

Options

SEE ALSO

On this page