Secrets

Secrets store sensitive values like API keys, database passwords, and encryption keys. They are encrypted at rest and injected into your application as environment variables at runtime.

Setting a secret

ske secret set APP_KEY

Value: ••••••••••••••••••••••••••••••••
✓ Secret APP_KEY set

The value is prompted with hidden input. To set it non-interactively (useful in scripts), use --value or pipe from stdin:

# Using --value flag
ske secret set DB_PASSWORD --value "your-password"

# Piping from stdin
printf '%s' "$SECRET_VALUE" | ske secret set STRIPE_KEY

Listing secrets

ske secret list

  KEY             LAST MODIFIED
  APP_KEY         2026-09-15 14:30
  DB_PASSWORD     2026-09-15 14:32
  STRIPE_KEY      2026-09-18 09:15

Secret values are never displayed — only the key name and last modification time.

Deleting a secret

ske secret delete STRIPE_KEY

Delete secret STRIPE_KEY? [y/N] y
✓ Secret STRIPE_KEY deleted

Use --force to skip the confirmation prompt:

ske secret delete STRIPE_KEY --force

Per-environment secrets

Secrets are scoped to an environment. Each environment has its own set of secrets. To manage secrets for a specific environment:

ske secret set DB_PASSWORD --env production
ske secret set DB_PASSWORD --env staging
ske secret list --env production

Storage

Secrets are stored in your cloud provider’s secret management service:

Provider	Storage
AWS	SSM Parameter Store (SecureString)
GCP	Secret Manager

SKE manages the lifecycle — creating, updating, and deleting secrets in your cloud account. The values are encrypted using your cloud provider’s default encryption keys and are only decrypted at runtime when your application starts.

When secrets take effect

Secrets are injected as environment variables when your application container starts. Changing a secret does not immediately affect running instances. The new value takes effect on the next deployment or redeployment.

To apply changed secrets without deploying new code, trigger an environment sync:

ske deploy --env production