opschain secret
Included from Basic tier
The local secret store: a per-user, per-machine store for the values local
runs resolve from secret-vault://<path>/<key> property references. It is
age-encrypted on disk at $OPSCHAIN_HOME/secrets/store.age and never leaves
this machine — the server's secret vault is a different thing, managed with
opschain vault (see opschain docs cli/vault).
| Subcommand | Does | Page |
|---|---|---|
set | Store a secret (value from argv or stdin) | opschain docs cli/secret-set |
get | Print a secret value | opschain docs cli/secret-get |
ls | List secret keys | opschain docs cli/secret-ls |
delete | Remove a secret | opschain docs cli/secret-delete |
audit | Audit a secret vault's encryption state (read-only) | opschain docs cli/secret-audit |
migrate | Re-encrypt vault values to the transportable key | opschain docs cli/secret-migrate |
The master key
The store is encrypted with an age X25519 master key, resolved in this
order: the OPSCHAIN_MASTER_KEY environment variable, the key file
$OPSCHAIN_HOME/secrets/master.key (which must be 0600 — looser
permissions are refused), then the OS keychain (service opschain, account
master-key). The global --no-keychain flag skips the keychain for both
resolution and generation.
On first use a master key is generated automatically: into the OS keychain,
or — with --no-keychain, or when the keychain is unavailable — into the
key file, with a printed warning. Every store command prints these first-use
notices on stderr before its own output, including recovery guidance: back
the AGE-SECRET-KEY-1… identity up, because losing it makes the stored
secrets unrecoverable.
Exit codes
| Code | Meaning |
|---|---|
| 0 | OK. |
| 1 | The command failed (e.g. key not found, unreadable store or master key). |
| 2 | Usage error. |
See also
opschain docs cli/vault— the server-side secret vault.opschain learn 3.5— secrets and vault, guided.