ezgh secrets read

ezgh secrets read <name> [--version N|latest] [--field K] [--format env|json|raw] [flags]

Print the values of a version (latest by default), or of one field with --field. This is the only command that prints values, and every read is billed and recorded in Trails.

--format env (the default) prints KEY=VALUE lines, quoted for a POSIX shell when a value needs it, so eval "$(ezgh secrets read prod/app)" and set -a; . <(…) work; a binary field can’t be printed that way and is refused. --format json prints the API’s answer ({“version”, “fields”}, or {“version”, “name”, “value”} for --field; a binary value is {“base64”: …}). --format raw needs --field and writes the value’s exact bytes (decoded, for a binary one), with no newline added.

Part of ezgh secrets.

Examples

ezgh secrets read prod/app > .env
ezgh secrets read prod/app --field TLS_KEY --format raw > key.der
eval "$(ezgh secrets read prod/app --version 2)"

Flags

This command also takes the global flags.