ast secrets

Manage the variables and secrets in the account vault or in one environment. Alias: ast secret.

ast secrets <subcommand> [--env <name> [--blueprint <name>]]

Without --env, every subcommand works on the account vault. With --env, it works on that environment’s values, which override the account’s values with the same name. The blueprint comes from --blueprint, or from astropods.yml in the current directory. list --env marks each entry that overrides an account value.

secrets list

ast secrets list [--values] [--json]

--values shows values for plain (non-secret) variables.

secrets create

ast secrets create <name> [--value <val>] [--plain] [--description <text>] [--overwrite]

Prompts for value when --value is omitted. Use --plain to store as a readable variable instead of an encrypted secret.

secrets update

ast secrets update <name> [--value <val>] [--plain] [--description <text>]

secrets get

ast secrets get <name> [--json]

secrets delete

ast secrets delete <name>

secrets import

Import variables from a file (e.g., .env). Blank values are skipped. Existing variables are skipped unless --overwrite is set.

ast secrets import --file <path> [--plain] [--plain-keys KEY1,KEY2] [--overwrite]

Next steps

• Managing secrets: how the account vault works and how agents read from it
• ast blueprint: reference a secret at deploy with --var KEY=@SECRET_NAME