opschain secret set
Included from Basic tier
opschain secret set <key> [value]
Stores a secret in the local secret store. With the value argument omitted
the value is read from stdin instead — on a terminal a value: prompt is
printed to stderr, and either way exactly one line is read, with the
trailing newline stripped. Prefer the stdin form: a value passed as an
argument is visible in shell history and process listings.
Keys are free-form. A key of the form <path>/<key> is what a
secret-vault://<path>/<key> property reference resolves to in local runs;
a bare key works for direct get/set use.
Setting an existing key overwrites its value. On success it prints
secret <key> set (suppressed by -q); first-use master-key notices go to
stderr first (see opschain docs cli/secret).
Exit codes
| Code | Meaning |
|---|---|
| 0 | Stored. |
| 1 | The store or master key could not be opened or written. |
| 2 | Usage error. |
Named errors
reading secret value from stdin: <cause>— stdin closed with no input.
Examples
Prompted on a terminal (the value is read with echo disabled, like the login and vault passphrase prompts — nothing appears as you type):
opschain secret set db/password
secret db/password set
Piped, keeping the value out of argv:
printf '%s\n' "$VALUE" | opschain secret set db/password
See also
opschain docs cli/secret-get,opschain docs cli/secret-ls,opschain docs cli/secret-delete.opschain learn 3.5— how local runs resolvesecret-vault://references.