ov app

An app is a named container for secrets belonging to a single project or service. When you have multiple projects, each gets its own app so secrets with the same name never collide.

Every app holds one or more environments (production, staging, dev, etc.). Secrets always live inside an env. New apps start with zero environments — you add them with ov env create or via the --with-env flag on ov app create.

Commands

Command	Description
`ov app create <slug>`	Create a new app (optionally with its first env)
`ov app list`	List all apps
`ov app use <slug>`	Set the default app for all commands
`ov app delete <slug>`	Delete an app and all its secrets

ov app create

ov app create my-saas
ov app create payments-service

Creates a new app. Slugs must be unique per account and match ^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$|^[a-z0-9]$ — 1–63 characters, lowercase letters and digits, with hyphens allowed in the middle. The first and last characters must be alphanumeric (single-character slugs like a are allowed; slugs starting or ending with a hyphen are not).

A fresh app has zero environments. To store secrets you need at least one env — either create it separately with ov env create, or use --with-env to do it in one step:

ov app create my-saas --with-env production

Flags

Flag	Description
`--name <string>`	Display name for the app (defaults to the slug)
`--with-env <slug>`	Also create an environment with this slug (e.g. `production`)

ov app list

ov app list

Default output — one row per app, parseable by scripts:

SLUG              NAME              CREATED                ACTIVE
my-saas           My SaaS           2026-04-01T12:00:00Z   *
payments-service  Payments Service  2026-04-08T09:30:00Z
default           default           2026-03-20T08:00:00Z

The * in the ACTIVE column marks the app set by ov app use.

Add --envs to also show each app’s environments with the active env marked *:

ov app list --envs

APP               ACTIVE  ENVS
my-saas           *       production*, staging, dev
payments-service          (none — run 'ov env create <slug> --app payments-service')
default                   production

--envs makes one extra API call per app, so it’s opt-in for scripts that parse the default shape.

ov app use

ov app use my-saas

Sets my-saas as the default app for all subsequent commands in any directory. Stored in ~/.config/ov/config.toml. Override per-command with --app.

ov app delete

ov app delete my-saas --confirm

Permanently deletes the app and all secrets in it. This cannot be undone. Requires --confirm.

On first login, OpaqueVault creates a default app so you can start storing secrets immediately without any setup. You can run ov app use my-saas to switch to your own app at any time.

ov secret — store and manage secrets in an app/env
ov status — show your current app, env, and resolution source
ov run — run commands with secrets injected