wardkey secrets
Read, write, list, and soft-delete secrets in the active org. Every subcommand honors the global flags, including --org, --project, --env, and --json.
wardkey secrets --help
list
List the paths of every secret in the active org's selected project + environment.
wardkey secrets list
# db/password
# prod/api/key
# prod/db/postgres
Pass --json for an array of path strings — convenient for piping into other commands.
wardkey secrets list --json | jq -r '.[]'
get
Fetch the current value of the secret at PATH.
wardkey secrets get PATH [--version N] [--json]
| Flag | Default | Meaning |
|---|---|---|
--version int | latest | Fetch a specific historical version instead of the current one. |
--json | off | Emit the full SecretValue envelope instead of the raw value. |
Examples:
# Default: raw value, trailing newline. Safe in scripts.
PASS=$(wardkey secrets get db/password)
# A specific historical version.
wardkey secrets get db/password --version 3
# The full envelope (path, version, content-type, value, created_at, …).
wardkey secrets get db/password --json
set
Write VALUE to PATH. Upsert semantics: if the path does not yet exist the API creates it; otherwise a new version is appended and the current-version pointer advances atomically.
wardkey secrets set PATH --value VALUE [--content-type TYPE] [--policy-hash HASH]
| Flag | Default | Meaning |
|---|---|---|
--value string | — | Required. The secret value to store. |
--content-type string | text/plain | MIME type of the value. Useful for binary payloads or JSON configs. |
--policy-hash string | — | Advanced. Expected policy hash for optimistic concurrency — the write is rejected if the server's hash differs. |
# Plain text
wardkey secrets set db/password --value 'hunter2'
# Multiline / JSON
wardkey secrets set app/config.json \
--value "$(cat ./config.json)" \
--content-type 'application/json'
delete
Mark the secret at PATH as deleted. Soft delete — the path remains reserved (no new secret may take its name) until the retention sweep hard-deletes the row.
wardkey secrets delete PATH
# or
wardkey secrets rm PATH
rm is a built-in alias for delete.