ezgh secrets <command>EZGH Secrets keeps sensitive values, such as the contents of a .env file, encrypted, in a project (--project, EZGH_PROJECT or the profile’s). A secret has a name (prod/db) and is made of fields: a field is a name (not confidential) and a value (up to 8 KiB, text or binary). Every change writes a new version; “latest” is the newest. A secret is named on the command line; ezgh finds it in the project by that name (or by ID).
Values are never printed except by ezgh secrets read, which is a billed read. Every other command shows names and metadata only.
Flags
This command also takes the global flags.
Subcommands
| Command | Description |
|---|---|
ezgh secrets create |
Create a secret, with its first version when fields are given |
ezgh secrets delete |
Delete a secret and every version |
ezgh secrets destroy-version |
Destroy a version’s values for good |
ezgh secrets get |
Show a secret’s metadata and the field names of its latest version |
ezgh secrets grants |
Grants: the products allowed to read a secret |
ezgh secrets list |
List the project’s secrets |
ezgh secrets put |
Write a new version of a secret |
ezgh secrets read |
Print a secret’s values (a billed read) |
ezgh secrets versions |
List a secret’s versions, newest first |