Secrets

shard secret

Manage secrets and sandbox access to them.

shard secret COMMAND [OPTIONS] [ARGS...]

Commands

Command	Description
shard secret set	store or update a secret
shard secret list	list secrets without their values
shard secret remove	delete a secret
shard secret grant	let a sandbox use a secret
shard secret ungrant	remove a sandbox’s access to a secret

Secret values stay outside the sandbox. They are inserted into HTTPS request headers sent to approved destinations.

shard secret set

Store or update a secret.

shard secret set [OPTIONS] NAME [VALUE]

Examples

shard secret set --destination api.example.com API_TOKEN
printf '%s' "$TOKEN" | shard secret set --destination api.example.com API_TOKEN

Arguments

Argument	Description
NAME	secret name; upper-case letters, digits and underscores
VALUE	secret value; omit it to read from input or a hidden prompt

Options

Option	Description	Default
--dest, --destination <host>	approved destination; required and repeatable
--placeholder <string>	value visible inside the sandbox	mock-NAME

The sandbox receives the placeholder instead of the secret value. In HTTPS request headers sent to approved destinations, shard puts the value in its place.

Set an existing secret again to update its value. Custom placeholders can contain letters, digits, underscores, hyphens and dots.

Avoid secret values in command arguments. Use input or the hidden prompt.

shard secret list

List secrets without their values.

shard secret list [OPTIONS]

Examples

shard secret list
shard secret list --format json

Options

Option	Description	Default
--format <format>	output format: json or table	table

Shows secret names, approved destinations, placeholders and update times.

shard secret remove

Delete a stored secret.

shard secret remove [OPTIONS] NAME

Example

shard secret remove API_TOKEN

Arguments

Argument	Description
NAME	secret name

Options

Option	Description
--force	delete the secret even if a sandbox uses it

shard secret grant

Let a sandbox use a stored secret.

shard secret grant SANDBOX NAME

Example

shard secret grant web API_TOKEN

Arguments

Argument	Description
SANDBOX	sandbox ID or name
NAME	secret name

The sandbox must be created or stopped. Its commands receive the secret’s placeholder as $NAME.

shard secret ungrant

Remove a sandbox’s access to a secret.

shard secret ungrant SANDBOX NAME

Example

shard secret ungrant web API_TOKEN

Arguments

Argument	Description
SANDBOX	sandbox ID or name
NAME	secret name

The sandbox must be created or stopped.