---
title: "ezgh secrets create"
description: "Create a secret, with its first version when fields are given."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh secrets create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh secrets create <name> [--from-env-file .env] [--set K=V]… [--description d] [--tag k=v]… [flags]
```

Create a secret in the project. &lt;name&gt; is letters, digits and \_ . / - (up to 128 characters, starting with a letter or digit), so prod/db is a name. When fields are given, with `--from-env-file` and `--set`, they make the secret's first version; without them the secret starts empty and `ezgh secrets put` adds a version.

`--set` KEY=VALUE sets a field; KEY=@file reads the value from a file (a file that isn't UTF-8 is sent as binary), and KEY=- reads it from stdin. `--set` wins over `--from-env-file`.

Part of [`ezgh secrets`](/cli/reference/secrets).

## Examples

```sh
ezgh secrets create prod/app --from-env-file .env
ezgh secrets create prod/db --set DATABASE_URL=postgres://… --set TLS_KEY=@key.pem --tag team=data
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--description` | string |  | a description |
| `--from-env-file` | string |  | read the first version's fields from a .env file: KEY=VALUE lines (# comments, export, and quoted values are understood) |
| `--set` | string, repeatable |  | set a field: KEY=VALUE, KEY=@file (the file's bytes) or KEY=- (stdin). Repeat for more |
| `--tag` | string, repeatable |  | a tag, key=value (repeat for more) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/secrets-create/index.mdx