secrets
ak secrets compare
Check whether a candidate value matches a stored secret without printing either.
Use ak secrets compare to check a .env entry or a pasted token against the
vault without --reveal. The answer is match or differs; neither value is
ever printed, logged or put in --json output.
Usage
ak secrets compare <ref> (--value=- | --value-file <path>) [--backend <backend>]Exactly one ref is required. The candidate is read the way
ak secrets set reads a value:
| Flag | Description |
|---|---|
--value - | Read the candidate from stdin. A literal value (--value=abc) is rejected. |
--value-file <path> | Read the candidate from a file. |
--backend <backend> | Backend that holds the stored value: keychain (default), file or memory. |
--unlock-with-recovery | Open the file backend's vault with a recovery private key and set a new passphrase. |
With neither flag, an interactive, non-echoing prompt asks for the candidate. The values are compared byte for byte, so a trailing newline counts. The two SHA-256 digests are compared in constant time.
A missing ref is reported before any value is read. Compare refuses, with exit
2, when the candidate or the stored value is shorter than 16 characters, not
counting a recognised public prefix (such as sk_live_) or one trailing line
end, and counting bytes for a value that is not UTF-8. This is the rule the
value hint in list, get and search uses, and a short candidate is refused
before the backend is read, so it never triggers a keychain or passphrase
prompt.
Reading the stored value may prompt for keychain consent or the vault
passphrase. When the audit ledger already exists, each call appends one row
with the ref and the result (match, differs or refused), never a value or
a hash of one; compare never creates the ledger. A ledger that cannot take the
row is a warning on stderr, and the answer still stands.
Output
Human stdout prints <ref>: match or <ref>: differs.
JSON success uses:
schema_version: 1
kind: secrets.compare
data.ref
data.match: true | false
data.result: match | differsExit behavior
| Exit | Meaning |
|---|---|
0 | Compared; the answer (match or differs) is in the output. |
2 | Invalid flags or arguments, an unreadable --value-file, or a candidate or stored value shorter than 16 characters. |
3 | The ref has no stored value. |
5 | Backend or index failure. |