#Secrets
| Command | Purpose |
|---|---|
vatio secrets list / set KEY [VALUE] / rm KEY | Manage workspace secrets |
... --env NAME | The value one environment uses instead |
... --tests | The value preview, and every eval replay, uses instead |
Leave VALUE out and set asks for it with the input hidden, so the value
stays out of your shell history. Off a terminal it reads stdin:
op read op://Vault/item/field | vatio secrets set KEY.
Keys use uppercase letters, digits and underscores, starting with a letter.
Keys starting with VATIO_, and DISPATCHER, are reserved for Vatio. Tools
read values with $env.KEY.
Without --env a secret is the value everywhere. With --env preview or
--env live, it is the value only that environment uses, replacing the one
everywhere else. set and rm print which one they touched:
(every environment), (only preview) or (tests).
list shows every secret of the workspace, each environment's own included,
with its scope on the same line. list --env NAME shows only what that
environment reads.
With --tests it is the test value: what preview uses, and every eval replay,
live's included. A staging URL set once covers all of them; list marks it
(tests). --tests and --env do not go together.
list returns names, never values. Changes take effect on subsequent tool
calls without deploying — a rollback does not restore an old value. See
Secrets.
Never put a private signing key in here: that store is read by Vatio, and the whole point of authentication is that Vatio holds only your public key.