Secrets

Secrets store sensitive values like API keys, database passwords, and encryption keys. They are encrypted at rest and injected into your application as environment variables at runtime.

Setting a secret

ske secret set STRIPE_KEY

Value:
Secret STRIPE_KEY set.

APP_KEY is created for you when the environment is created, so you don’t need to set it.

The value is prompted with hidden input. To set it non-interactively (useful in scripts), use --value or pipe from stdin:

# Using --value flag
ske secret set MAIL_PASSWORD --value "your-password"

# Piping from stdin
printf '%s' "$SECRET_VALUE" | ske secret set STRIPE_KEY

Listing secrets

ske secret list

KEY            LAST MODIFIED
APP_KEY        2026-09-15 14:30
MAIL_PASSWORD  2026-09-15 14:32
STRIPE_KEY     2026-09-18 09:15

Secret values are never displayed — only the key name and last modification time.

Deleting a secret

ske secret delete STRIPE_KEY

Delete secret STRIPE_KEY? [y/N] y
Secret STRIPE_KEY deleted.

Use --force to skip the confirmation prompt:

ske secret delete STRIPE_KEY --force

Importing from a .env file

ske secret import .env.production

KEY            ACTION     LINE  NOTE
MAIL_PASSWORD  change     3
SENTRY_DSN     add        5
STRIPE_KEY     unchanged  7

1 to add, 1 to change, 1 unchanged, 0 to remove, 0 skipped.
Apply 2 changes to production? [y/N] y
Secrets imported: 1 added, 1 changed, 0 removed.

ske secret import prints what changes first, never showing values, then asks before applying. --dry-run only prints the changes, --yes applies without asking, and --prune also removes secrets the file doesn’t set. - reads the file from standard input. A file with lines that can’t be read changes nothing.

A key that overrides a value SKE injects, such as DB_HOST, is marked overrides the platform's value.

Per-environment secrets

Secrets are scoped to an environment. Each environment has its own set of secrets. To manage secrets for a specific environment:

ske secret set MAIL_PASSWORD --env production
ske secret set MAIL_PASSWORD --env staging
ske secret list --env production

Storage

Secrets are stored in your cloud provider’s secret management service:

Provider	Storage
AWS	SSM Parameter Store (SecureString)
GCP	Secret Manager

SKE manages the lifecycle — creating, updating, and deleting secrets in your cloud account. The values are encrypted using your cloud provider’s default encryption keys and are only decrypted at runtime when your application starts.

When secrets take effect

Secrets are injected as environment variables when your application container starts. Changing a secret does not immediately affect running instances. The new value takes effect on the next deployment or redeployment.

To apply changed secrets without deploying new code, trigger an environment sync:

ske deploy --env production