opschain vault store
Included from Basic tier
opschain vault store <node-path> --path secret-vault://<path>/<key> \
[--value-env <var> | --value-prompt | --value-file <file>] [--replace]
Stores a secret value in the server's vault under a secret-vault:// URL,
owned by the node the positional path names — e.g. demo,
demo/environments/dev or demo/environments/dev/assets/web (a full
/projects/... path also works). The owner scopes who may write: the caller
needs updatable on the node's secrets path, or on /secrets. Server-only
(see opschain docs cli/vault).
The value arrives through exactly one of the value flags; with none the
server generates a value. The vault refuses to overwrite an existing
value unless --replace is given.
An unqualified URL writes to the platform's default secrets provider. Under
multi-vault, a provider-qualified URL —
secret-vault://<provider-code>@<path>/<key> — writes through the named
provider instead, authenticated with YOUR stored credential for it (store
one first; without one the write is refused with a typed error, and an
unknown or disabled provider code is refused by name — a qualified write
never falls back to a different vault). The plaintext never echoes: the server
returns the stored value only in the cipher-stacked form (an
{AES2}-prefixed blob — the server's own encryption layer over the
backend's at-rest encryption; see opschain learn 3.5), and a vault
configured to store plaintext (vault.cipher_stacking: "false") returns
the placeholder
(the stored value is not cipher-stacked and is not returned) instead.
Flags
| Flag | Meaning |
|---|---|
--path <url> | The secret-vault://<path>/<key> URL to store under (required). |
--value-env <var> | Name of an environment variable holding the value — never pass the value itself on the command line. |
--value-prompt | Prompt for the value without echo (reads a line from stdin when piped). |
--value-file <file> | Path to a file holding the value. |
--replace | Overwrite an existing value at the URL (refused otherwise). |
The three value flags are mutually exclusive; omitting all of them asks the server to generate the value.
Output
opschain vault store demo --path secret-vault://db/password --value-env DB_PASSWORD
stored secret at secret-vault://db/password
stored value (cipher-stacked): {AES2}…
A generated value prints stored generated secret at <url> — and since the
plaintext is never returned, a generated secret is only usable via its
secret-vault:// reference (or opschain vault global). With -o json or
-o yaml the result is a document with path, stored and generated
fields. The cipher-stacked stored value is what opschain vault global
takes as the expected value.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Stored. |
| 1 | The server refused (e.g. the value exists and --replace was not given, or authorisation failed) or the request failed. |
| 2 | Usage error. |
Named errors
--value-env, --value-prompt and --value-file are mutually exclusive(exit 2).--value-env <var>: the environment variable is not set (or empty)(exit 2).expected a node path like demo, demo/environments/dev or /projects/demo/environments/dev/assets/web, got "<arg>"(exit 2).- Server refusals arrive as
ERROR:results and surface verbatim (exit 1).
See also
opschain docs cli/vault-store-file— store a file's content instead.opschain docs cli/vault-global— resolve a stored value back to plaintext.opschain learn 3.5— secrets and vault, guided.