opschain vault encrypt
Included from Basic tier
opschain vault encrypt (--value-env <var> | --value-prompt | --value-file <file>)
Cipher-stacks a value — encrypts it with the server's encryption keys (the
transportable key when one is configured) — and prints the ciphertext to
stdout — paste it into settings or properties that accept encrypted values.
Requires updatable on /secrets. Server-only (see opschain docs cli/vault).
The plaintext never echoes and never travels through argv — exactly one
value flag supplies it. A blank value or a secret-vault:// reference comes
back unchanged by the server (references are resolved at run time, not
encrypted).
Flags
| Flag | Meaning |
|---|---|
--value-env <var> | Name of an environment variable holding the value to encrypt — never pass the value itself on the command line. |
--value-prompt | Prompt for the value without echo (reads a line from stdin when piped). |
--value-file <file> | Path to a file holding the value to encrypt. |
The three flags are mutually exclusive, and one is required.
Output
The ciphertext, bare on stdout — or, with -o json / -o yaml, a document
with a single result field.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Encrypted. |
| 1 | The server refused (authorisation) or the request failed. |
| 2 | Usage error. |
Named errors
a value is required — pass --value-env, --value-prompt or --value-file(exit 2).--value-env, --value-prompt and --value-file are mutually exclusive(exit 2).--value-env <var>: the environment variable is not set (or empty)(exit 2).- Server refusals arrive as
ERROR:results and surface verbatim (exit 1).
Examples
opschain vault encrypt --value-env DB_PASSWORD
See also
opschain docs cli/vault-store— store a value in the vault instead of carrying ciphertext yourself.opschain learn 3.5— secrets and vault, guided.