kindgi secrets

`kindgi secrets`

Synopsis

kindgi secrets <command>

Signature

Manage per-environment secrets via the /v1/secrets/* wire.

Commands

Command	Description
`kindgi secrets list`	List secret metadata under --scope + --env.
`kindgi secrets get`	Fetch secret metadata (name + version + timestamps only, NEVER the value).
`kindgi secrets set`	Write a new secret value.
`kindgi secrets copy`	Copy model providers' keys (or the NAMEs given) from your app's env files into Kindgi's own .kindgi/secrets.env, which Kindgi reads first.
`kindgi secrets rotate`	Rotate a secret.
`kindgi secrets revoke`	Revoke a secret.
`kindgi secrets pull`	Fetch secret metadata into .secrets/<envName>/manifest.json.

See also

`kindgi secrets list`

Synopsis

kindgi secrets list --env=<name> --scope=<kind>[:id] [--include-revoked] [--name-prefix=<p>] [--cursor=<c>] [--limit=<n>]

Signature

List secret metadata under --scope + --env. Never returns values.

Options

Option	Default	Description
`--cursor <value>`	none	Resume after this cursor, from the previous page's `nextCursor`.
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--include-revoked`	off	Include revoked secrets, with their `revokedAt` and `revokeReason`. Never a value.
`--limit <value>`	`25` (at most `100`)	The most secrets to return (default 25, at most 100).
`--name-prefix <value>`	none	Only the secrets whose name starts with this prefix.
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.

Every command also takes the global flags.

Examples

List the tenant's secrets for the local env.

kindgi secrets list --env=local --scope=tenant

Page through the secrets whose names start with ACME_.

kindgi secrets list --env=production --scope=tenant --name-prefix=ACME_ --limit=10

List revoked secrets too, with when and why each was revoked.

kindgi secrets list --env=production --scope=tenant --include-revoked

See also

`kindgi secrets get`

Synopsis

kindgi secrets get <NAME> --env=<name> --scope=<kind>[:id]

Signature

Fetch secret metadata (name + version + timestamps only, NEVER the value).

Options

Option	Default	Description
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.

Every command also takes the global flags.

Examples

From Store a secret:

pnpm exec kindgi secrets get RECEIPT_SIGNING_KEY --env=local --scope=tenant

See also

`kindgi secrets set`

Synopsis

kindgi secrets set <NAME> --env=<name> --scope=<kind>[:id] [--write-mode=create-new|add-version] [--from-stdin | --from-file <path>] [--rotation-due-at=<iso>] [--if-version=<n>] [--app]

Signature

Write a new secret value. Default: interactive TTY prompt. Use --from-stdin | --from-file for automation.

Options

Option	Default	Description
`--app`	off	Under `kindgi dev`: write it to your app's env file (the last of `dev.envFiles`, `.env.local` by default) instead of Kindgi's `.kindgi/secrets.env`, for a value your app reads too, such as a webhook signing secret.
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--from-file <value>`	none (prompts for the value on a terminal)	Read the value from this file instead of prompting. A file group or others can access is refused (`chmod 600`).
`--from-stdin`	off (prompts for the value on a terminal)	Read the secret's value from stdin instead of prompting.
`--if-version <value>`	none	Write only if the secret is still at this version (`0` when it doesn't exist yet); otherwise fail with a conflict.
`--rotation-due-at <value>`	none	When the secret is due for rotation: an ISO 8601 time with a zone, or a date (its start, UTC); kept with its metadata.
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.
`--write-mode <value>`	`create-new`	`create-new` (the default) refuses a secret that exists; `add-version` writes a new version, creating it if needed.

Every command also takes the global flags.

Examples

From Connect Anthropic:

pnpm exec kindgi secrets set ANTHROPIC_API_KEY --env=local --scope=tenant

From Connect OpenAI, Gemini, Groq or OpenRouter:

pnpm exec kindgi secrets set OPENAI_API_KEY --env=local --scope=tenant

See also

`kindgi secrets copy`

Synopsis

kindgi secrets copy [NAME…]

Signature

Copy model providers' keys (or the NAMEs given) from your app's env files into Kindgi's own .kindgi/secrets.env, which Kindgi reads first. Never edits your app's files.

Options

Every command also takes the global flags.

Examples

From Keep local values in env files:

pnpm exec kindgi secrets copy

See also

`kindgi secrets rotate`

Synopsis

kindgi secrets rotate <NAME> --env=<name> --scope=<kind>[:id] [--new-value | --from-stdin | --from-file <path>] [--revoke-old-after=<ms>] [--no-wait]

Signature

Rotate a secret. Async providers polled to terminal; use --no-wait to bypass polling and return wire response.

Options

Option	Default	Description
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--from-file <value>`	none (the secret store rotates the value itself unless `--new-value` or `--from-stdin`)	Read the new value from this file. A file group or others can access is refused (`chmod 600`).
`--from-stdin`	off	Read the new value from stdin.
`--new-value`	off	Prompt for the new value (no echo). Without it, `--from-stdin` or `--from-file`, the secret store must rotate the value itself.
`--no-wait`	off (waits for an asynchronous rotation to finish)	Print the API's first response instead of waiting for an asynchronous rotation to finish.
`--revoke-old-after <value>`	none (the old version stays valid)	Revoke the old version this many milliseconds after the rotation (`0`: at once). Without it, the old version stays valid.
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.

Every command also takes the global flags.

Examples

Rotate a secret, entering the new value at a prompt.

kindgi secrets rotate ACME_WEBHOOK_SECRET --env=production --scope=tenant --new-value

Rotate from stdin and revoke the old version after an hour.

kindgi secrets rotate ACME_WEBHOOK_SECRET --env=production --scope=tenant --from-stdin --revoke-old-after=3600000

See also

`kindgi secrets revoke`

Synopsis

kindgi secrets revoke <NAME> --env=<name> --scope=<kind>[:id] [--hard] [--reason=<r>]

Signature

Revoke a secret. Default: soft (keeps audit tombstone). --hard: cryptographic erasure.

Options

Option	Default	Description
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--hard`	off (soft revoke, keeps an audit tombstone)	Erase the value for good instead of keeping an audit tombstone. Cannot be undone.
`--reason <value>`	none	Why the secret is revoked; kept on the record as `revokeReason`.
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.

Every command also takes the global flags.

Examples

Revoke a secret, keeping an audit tombstone.

kindgi secrets revoke ACME_WEBHOOK_SECRET --env=production --scope=tenant --reason="rotated after a leak"

Erase a secret's value for good.

kindgi secrets revoke ACME_OLD_KEY --env=production --scope=tenant --hard

See also

`kindgi secrets pull`

Synopsis

kindgi secrets pull --env=<name> --scope=<kind>[:id] [--path <dir>]

Signature

Fetch secret metadata into .secrets/<envName>/manifest.json. Never fetches bytes.

Options

Option	Default	Description
`--env <value>`	required	The environment the secret belongs to. Required; under `kindgi dev`, `local` is the pack's env files.
`--path <value>`	the current directory	The pack directory to write `.secrets/<env>/manifest.json` under (default: the current directory).
`--scope <value>`	required	Where the secret lives: `tenant`, `org:<orgId>` or `project:<projectId>`. Required.

Every command also takes the global flags.

Examples

Write the tenant's secret metadata to .secrets/production/manifest.json.

kindgi secrets pull --env=production --scope=tenant

Write the manifest under another pack directory.

kindgi secrets pull --env=staging --scope=project:<project-id> --path=./acme-ops

See also