# Secrets

| Command | Purpose |
|---|---|
| `vatio secrets list` / `set KEY [VALUE]` / `rm KEY` | Manage workspace secrets |
| `... --env NAME` | The value one environment uses instead |
| `... --tests` | The value preview, and every eval replay, uses instead |

Leave `VALUE` out and `set` asks for it with the input hidden, so the value
stays out of your shell history. Off a terminal it reads stdin:
`op read op://Vault/item/field | vatio secrets set KEY`.

Keys use uppercase letters, digits and underscores, starting with a letter.
Keys starting with `VATIO_`, and `DISPATCHER`, are reserved for Vatio. Tools
read values with `$env.KEY`.

Without `--env` a secret is the value everywhere. With `--env preview` or
`--env live`, it is the value only that environment uses, replacing the one
everywhere else. `set` and `rm` print which one they touched:
`(every environment)`, `(only preview)` or `(tests)`.

`list` shows every secret of the workspace, each environment's own included,
with its scope on the same line. `list --env NAME` shows only what that
environment reads.

With `--tests` it is the test value: what preview uses, and every eval replay,
live's included. A staging URL set once covers all of them; `list` marks it
`(tests)`. `--tests` and `--env` do not go together.

`list` returns names, never values. Changes take effect on subsequent tool
calls without deploying — a rollback does not restore an old value. See
[Secrets](https://vatio.ai/docs/deployments#secrets).

Never put a private signing key in here: that store is read by Vatio, and the
whole point of [authentication](https://vatio.ai/docs/authentication/) is that Vatio holds only your
public key.