ak secrets export

Use ak secrets export for the operation described below. The command help records its arguments, effects, and options.

Command contract

Emit a versioned inventory of every stored secret

Synopsis

Emit a schema-versioned inventory (schema_version 1) of every stored ref: name, creator, created/rotated timestamps, its rotation window in days, and how many grants name it. Values are excluded unless --include-values is passed, and that flag requires --out <path>.age: a value is never written to stdout or a terminal, in any mode including --json. --include-values asks for a y/N confirmation on stderr, then twice for a new passphrase, and seals the document to that passphrase with age before writing it; nothing on this host keeps that passphrase, so losing it loses the export, the same trade as any other age-encrypted backup you keep yourself. Without --include-values, --out (any extension) writes the bare plaintext document (mode 0600); omitted, it goes to stdout instead, wrapped in the usual envelope under --json or as a table otherwise. Use it to inventory a host before a migration, or to hand an auditor the list of refs without the secrets.

Effects: Reads the index and the grants file; reads the backend once per ref only with --include-values. Writes the --out path (mode 0600), replacing an existing file there and saying so; with --include-values the file is age-encrypted, sealed to a passphrase entered at the prompt and stored nowhere on this host.

Exit status: 0 success 2 invalid flags; for --include-values, --out is missing, does not end in .age, names stdout/a terminal/a symlink/a directory, or the confirmation/passphrase was declined, did not match, or was never entered (stdin closed or Ctrl-D at the prompt) 3 a listed ref has no stored value (only with --include-values) 5 backend, index, encryption, or --out write failure

ak secrets export [flags]

Examples

  ak secrets export --json                          # inventory on stdout, metadata only
  ak secrets export --out ./inventory.json          # bare document in a 0600 file
  ak secrets export --include-values --out ./v.age  # prompts, writes an age-encrypted file

Options

      --backend string         Storage backend: keychain (default), file (age-encrypted vault), or memory (dev/test; values and its index are throwaway)
  -h, --help                   help for export
      --include-values         Include every value, age-encrypted to a passphrase you enter (requires --out <path>.age)
      --json                   Emit machine-readable JSON (implies --no-interactive)
      --no-interactive         Disable interactive prompts (CI-safe)
      --out string             Write the export to this path (mode 0600) instead of stdout; --include-values requires this and a .age extension
  -q, --quiet                  Suppress non-error output on stderr
      --unlock-with-recovery   Open the file backend's vault with a recovery private key and set a new passphrase
  -V, --verbose                Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes                    Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)