opschain vault

Included from Basic tier

The server's secret vault holds the values properties reference as secret-vault://<path>/<key> — runs resolve the reference at execution time, so the secret itself never lives in properties, files or logs. The group is server-only: pass --server <url> or select a context with opschain context use. The local opschain secret store is a different thing — a per-user store on this machine for local runs (see opschain docs cli/secret).

Subcommand	Does	Page
store	Store (or have the server generate) a secret value under a vault URL	opschain docs cli/vault-store
store-file	Store a file's content under a vault URL	opschain docs cli/vault-store-file
encrypt	Cipher-stack (encrypt) a value with the server's encryption keys	opschain docs cli/vault-encrypt
global	Resolve one vault value to plaintext, proving the stored value first	opschain docs cli/vault-global

Two properties hold across the whole family:

• Secret values never travel through argv. Every value arrives via a named environment variable (--value-env / --expected-env), a no-echo prompt (--value-prompt / --expected-prompt) or a file (--value-file / --expected-file), and the commands never echo it — the server returns only the cipher-stacked stored form (or a placeholder when the vault stores plaintext).
• Refusals are embedded. The /api/secrets endpoints answer refusals as ERROR: results inside an HTTP 200; the CLI surfaces them as ordinary command failures (exit 1).

Named errors

Any vault command on a local target is refused (exit 2) with:

the secret vault lives behind a server — pass --server <url> or 'opschain context use <name>' (the local `opschain secret` store is `opschain secret set|get|ls|delete`)

See also

• opschain docs cli/secret — the local secret store.
• opschain learn 3.5 — secrets and vault, guided.