secrets
ak secrets rotate
Replace an existing secret's value
Use ak secrets rotate for the operation described below. The command help records its arguments, effects, and options.
Command contract
Replace an existing secret's value
Synopsis
Replace <ref>'s stored value with a new one, read the same way as ak secrets set: --value=- (stdin), --value-file=<path>, or an interactive, non-echoing prompt — never --value=<literal>. Unlike set, rotate requires ref to already exist: it always overwrites (like set --force), so confirming existence first catches a typo'd ref instead of silently creating a new secret under the wrong name. Use it when a credential's value changed, expired, or is being rotated as a precaution.
Effects: Overwrites the value in the active backend and updates the ref's metadata (rotatedAt) in ~/.agentkit/secrets/index.json.
Exit status: 0 success 2 invalid flags or arguments 3 ref has no stored value (rotate never creates one) 5 backend or index failure
ak secrets rotate <ref> [flags]Examples
ak secrets rotate ${REF} # interactive prompt
echo -n "${VALUE}" | ak secrets rotate ${REF} --value=- # pipe from stdin
ak secrets rotate ${REF} --value-file ${PATH} # read from a fileOptions
--backend string Storage backend: keychain (default), file (age-encrypted vault), or memory (dev/test; values and its index are throwaway)
-h, --help help for rotate
--json Emit machine-readable JSON (implies --no-interactive)
--no-interactive Disable interactive prompts (CI-safe)
-q, --quiet Suppress non-error output on stderr
--unlock-with-recovery Open the file backend's vault with a recovery private key and set a new passphrase
--value string Secret value source: '-' reads from stdin. A literal value is rejected — use --value=- or --value-file
--value-file string Path to a file containing the secret value
-V, --verbose Extra diagnostic output on stderr (loses to --quiet)
-y, --yes Assume yes for all promptsSEE ALSO
- ak secrets - Manage named secret values (API keys, tokens)