Skip to main content

​
Overview

The applad security secrets commands manage secret values for your projects. Secret keys are stored encrypted in the admin database. Values are never shown in terminal output — only key names are displayed. All secret operations are recorded in the audit trail.

​
Commands

​
applad security secrets list

Lists all secret keys currently set for the active project. Keys only — values are never shown in any output. Use this to audit which secrets are configured without exposing them. 
applad security secrets list

​
applad security secrets set

Interactively sets a secret value. Prompts you to enter the value without echoing it to the terminal, so it never appears in shell history or logs. Stores it encrypted in the admin database. 
applad security secrets set <key>
Example: 
applad security secrets set DATABASE_PASSWORD
# You'll be prompted to enter the value securely

​
applad security secrets rotate

Rotates a secret — sets a new value, updates any references to it, and records the rotation event in the audit trail. The old value is immediately invalidated. 
applad security secrets rotate <key>
Example: 
applad security secrets rotate API_SECRET_KEY
# You'll be prompted to enter the new value

​
applad security secrets delete

Permanently deletes a secret. Any config that references it via ${VAR} will fail to validate until a new value is set or the reference is removed. 
applad security secrets delete <key>

​
Environment Variables

Environment variables and secrets work together in Applad. Every ${VAR} reference in your yaml files is tracked, and .env.example files are auto-generated.

​
applad env list

Lists all environment variable keys currently set for the active project. Values are never shown — keys only. This is intentional: secrets should never appear in terminal output. 
applad env list
For a specific project: 
applad env list --project <id>

​
applad env set

Sets an environment variable for the running instance. Takes effect immediately without requiring a restart. 
applad env set KEY=value

​
applad env unset

Removes an environment variable from the running instance. 
applad env unset KEY

​
applad env validate

Checks that every ${VAR} reference in the config tree has a corresponding value set in the environment. Fails with a clear error message naming the missing variable and the exact config file that references it. 
applad env validate
For a specific environment: 
applad env validate --env production

​
applad env generate

Scans all yaml files in the active project, extracts every ${VAR} reference, and generates a .env.example file annotated with which config file uses each variable, what format it expects, and whether it should be treated as a secret. 
applad env generate
For all projects in an org: 
applad env generate --org acme-corp
For all projects across the instance: 
applad env generate --all
For a specific environment: 
applad env generate --env production

​
applad env diff

Shows the difference between the variables referenced in your config files and what’s actually set in your .env. Highlights variables that are referenced but missing, and variables that are set in .env but not referenced anywhere in the config (potential dead config). 
applad env diff

​
applad env pull

Pulls the environment variables from the running instance down to a local .env file. Values are included. Use with care — the resulting .env file contains real secrets and should never be committed to version control. Applad’s .gitignore excludes .env files automatically. 
applad env pull

​
applad env push

Pushes your local .env file to the running instance, setting all variables in one operation. Variables not present in the .env file are left unchanged on the instance. 
applad env push

​
Examples

​
Set up secrets for a new project

# Generate .env.example to see what's needed
applad env generate

# Set each secret interactively
applad security secrets set DATABASE_PASSWORD
applad security secrets set API_SECRET_KEY
applad security secrets set STRIPE_SECRET_KEY

# Validate all secrets are set
applad env validate

​
Rotate an API key

# Rotate the secret
applad security secrets rotate API_SECRET_KEY

# Verify the change didn't break anything
applad env validate

​
Audit configured secrets

# List all secret keys (no values shown)
applad security secrets list

# Check for missing variables
applad env diff

​
Prepare production environment variables

# Generate production-specific .env.example
applad env generate --env production

# Validate production is ready
applad env validate --env production

​
Best Practices

  • Never commit .env files: Applad’s generated .gitignore excludes them automatically
  • Use ${VAR} references: Always reference secrets via ${VAR} in yaml files, never hardcode them
  • Rotate regularly: Use applad security secrets rotate to update secrets periodically
  • Validate before deploy: Run applad env validate before pushing to production
  • Use scoped keys in CI: Create deployment keys with limited scopes for CI/CD pipelines

Build docs developers (and LLMs) love

Get started for freeTalk to us