ov secret
import { Aside } from ‘@astrojs/starlight/components’;
App context
Section titled “App context”Every secret lives inside an app. The CLI resolves which app to target in this order:
--appflag (highest priority)- Your configured default (set via
ov app use)
ov app use my-saas # set default onceov secret set DATABASE_URL # targets my-saas automaticallyov secret list # lists secrets in my-saasCommands
Section titled “Commands”| Command | Description |
|---|---|
ov secret set <name> | Create or update a secret |
ov secret get <name> | Decrypt and print a secret value to stdout |
ov secret delete <name> | Delete a secret |
ov secret list | List all secret names in the active app |
ov secret import <file> | Bulk import from .env, JSON, CSV, or a secret manager export |
ov secret set
Section titled “ov secret set”ov secret set DATABASE_URLov secret set DATABASE_URL --app my-saasPrompts for the value (hidden input). Encrypts locally with a fresh DEK, stores ciphertext on the server. If the secret already exists it is updated in place with a new DEK.
ov secret get
Section titled “ov secret get”ov secret get DATABASE_URLov secret get DATABASE_URL --app my-saasFetches the encrypted blob, decrypts locally, prints plaintext to stdout.
Pipe to clipboard (macOS):
ov secret get DATABASE_URL | pbcopyov secret delete
Section titled “ov secret delete”ov secret delete DATABASE_URLov secret delete DATABASE_URL --app my-saasDeletes the ciphertext blob from the server. The deletion is logged to the audit trail.
ov secret list
Section titled “ov secret list”ov secret listov secret list --app my-saasLists all secret names for the active app. Values are never returned.
Output:
App: my-saas
NAME UPDATEDDATABASE_URL 2026-04-10T14:32:11ZOPENAI_API_KEY 2026-04-01T09:00:00ZSTRIPE_SECRET_KEY 2026-04-05T11:45:00Zov secret import
Section titled “ov secret import”ov secret import .env.production --app my-saasov secret import secrets.json --app my-saas --dry-runBulk import from any major format. Supported sources:
| Format | Flag / auto-detected |
|---|---|
.env file | auto-detected or --source env |
JSON {"KEY": "value"} | auto-detected or --source json |
| CSV | --source csv |
| 1Password export | --source 1password |
| Bitwarden export | --source bitwarden |
| LastPass export | --source lastpass |
| Dashlane export | --source dashlane |
| Doppler export | --source doppler |
| Infisical export | --source infisical |
| HashiCorp Vault export | --source vault |
| AWS Secrets Manager export | --source awssm |
Use --dry-run to preview what would be imported without storing anything.
| Flag | Description |
|---|---|
--app NAME | Target app (overrides default) |