opschain vault global
Included from Basic tier
opschain vault global <node-path> --path secret-vault://<path>/<key> \
(--expected-env <var> | --expected-prompt | --expected-file <file>)
Fetches and decrypts one vault value by its secret-vault:// URL — the
global-secret lane, gated on executable at /secrets (superusers pass).
Server-only (see opschain docs cli/vault). On an estate whose secrets
live in a registered SecretsProvider, the read additionally authenticates
to the vault with YOUR stored credential
(SecretService.SetUserVaultCredential) — never the platform's — so the
vault's own ACLs govern it, and a caller without one is refused by name.
Every read is audited (address, never the value). Under multi-vault a
provider-qualified URL (secret-vault://<provider-code>@<path>/<key>)
resolves through the named provider with your stored credential for it;
an unknown or disabled provider code is refused by name, never answered from
a different vault.
The server only answers when the supplied expected value matches the stored
(still-encrypted) value exactly, so the caller must already hold the stored
form — e.g. the stored value (cipher-stacked) line from
opschain vault store's output. The expected value travels via environment
variable, prompt or file, never argv. The positional node path names the
owning node, as for opschain vault store.
The decrypted plaintext prints to stdout — it is the requested output, so redirect accordingly.
Flags
| Flag | Meaning |
|---|---|
--path <url> | The secret-vault://<path>/<key> URL to resolve (required). |
--expected-env <var> | Name of an environment variable holding the stored (encrypted) value the vault must currently hold. |
--expected-prompt | Prompt for the stored value without echo (reads a line from stdin when piped). |
--expected-file <file> | Path to a file holding the stored value. |
The three expected-value flags are mutually exclusive, and one is required.
With -o json / -o yaml the plaintext is wrapped in a document with a
single result field.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Resolved; the plaintext is on stdout. |
| 1 | The server refused (expected value mismatch, authorisation) or the request failed. |
| 2 | Usage error. |
Named errors
the stored value to prove is required — pass --expected-env, --expected-prompt or --expected-file(exit 2).--expected-env, --expected-prompt and --expected-file are mutually exclusive(exit 2).--expected-env <var>: the environment variable is not set (or empty)(exit 2).expected a node path like demo, demo/environments/dev or /projects/demo/environments/dev/assets/web, got "<arg>"(exit 2).- Server refusals arrive as
ERROR:results and surface verbatim (exit 1).
Examples
STORED='…' opschain vault global demo --path secret-vault://db/password --expected-env STORED > password.txt
See also
opschain docs cli/vault-store— where the stored (encrypted) form comes from.opschain learn 3.5— secrets and vault, guided.