jex secrets

Manage secrets in the vault. The secrets command has four subcommands.

jex secrets pull

Pull all secrets for the current environment and write them atomically to .env.

jex secrets pull [--env <name>]

The write is atomic: Jex writes to a temp file in the same directory, then calls os.Rename(). If the process is interrupted, you won’t end up with a partial .env.

Add .env to your .gitignore. The pulled file contains plaintext secrets.

jex secrets push

Push secrets from a local .env file to the vault.

jex secrets push [--env <name>]

Reads the .env file in the current directory, parses key-value pairs, and calls the bulk import API endpoint. Useful for migrating an existing project.

Output:

Pushed 12 secrets (10 created, 2 updated).

jex secrets set

Set a single secret.

jex secrets set KEY=value [--env <name>]

Creates the key if it doesn’t exist; updates it if it does.

jex secrets set DATABASE_URL=postgres://user:pass@host/db
jex secrets set STRIPE_KEY=sk_live_...

jex secrets list

List the key names in the current environment (values are never shown).

jex secrets list [--env <name>]

Output is a styled table showing key names only. Secrets are never printed to the terminal by this command.

Common flags

All jex secrets subcommands accept:

See also

• jex run — inject secrets without writing to disk
• Environments — managing dev / staging / prod