Secrets

These commands work on individual secrets in the current environment. Override the environment on any of them with -e, --env <name>.

klef set

Create or update a single secret.

klef set DATABASE_URL postgres://localhost:5432/app

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.

Print the decrypted value of a single secret.

klef get DATABASE_URL

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.
`-r, --raw`	Print without a trailing newline (pipe-friendly).

--raw is handy in scripts and command substitution:

export DATABASE_URL="$(klef get DATABASE_URL --raw)"

Remove a single secret from the current environment.

klef unset DATABASE_URL

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.

Rename a secret, keeping its value.

klef rename OLD_KEY NEW_KEY

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.

List the keys in the current environment. Values are never printed by list, only key names.

klef list

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.
`-s, --search <term>`	Substring filter on key name.
`--sort <field>`	Sort by `key` (default) or `updated`.

klef list --search API --sort updated

Show the change timeline for a secret.

klef history DATABASE_URL

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.
`--values`	Decrypt and print each version value (slower).

klef history DATABASE_URL --values

Roll a secret back to a specific version. Use the version id printed by klef history.

klef restore 0c1f...e9

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.
`-y, --yes`	Skip the confirmation prompt.