Secrets & Environment Variables
The secrets and env commands are at the core of OneGuard's CLI capabilities. They allow you to securely store and fetch encrypted key-value pairs that are stored directly in your Vault.
All secrets are End-to-End encrypted locally using the CLI's encryption engine before they are sent to the OneGuard Server.
Environment (env) Commands
pull
Pull the environment variables for a specific secret, decrypt them locally, and write them directly to your .env file.
Usage:
Options: ---id (Required): The secret ID (or 8-character prefix).
- --project (Optional): The project ID. If omitted, the CLI searches across all projects in your organization.
- --path: The local path to save the variables (default: .env or value set by secrets set-path).
sync
Sync environment variables intelligently without passing flags.
When run for the first time in a directory, it will interactively prompt you to select a project and a secret, and save this configuration in a local .oneguard file. Subsequent runs will instantly fetch the latest version of the secret.
Usage:
sync --reset
Sometimes you may want to stop syncing a specific secret to your local directory without actually deleting the .env file that was already generated.
Passing the --reset flag will delete the local .oneguard configuration file (which holds the sync mapping), effectively breaking the link.
Usage:
Note: This does not delete your.env file. It only resets the CLI's memory of which secret to sync for this folder.
resync
If you need to change the project or secret you are currently syncing to this folder, use resync.
This command combines the behavior of --reset and sync. It will immediately clear your old configuration and start the interactive setup prompt again so you can choose a new project and secret to sync.
Usage:
Secrets (secrets) Commands
list
List all secrets associated with a specific project.
Usage:
Note: The output lists your secrets and automatically truncates their UUIDs to an 8-character prefix for easier reading and use in other commands.Options:
- --project (Required): The project ID (or 8-character prefix).
add
Add a new secret to a project. You can provide a single key/value pair or a full .env file.
Usage:
# Add a single key/value
oneguard secrets add --project <project_id> --name "Production Env" --key "DB_PASSWORD" --value "supersecret"
# Add from an existing .env file
oneguard secrets add --project <project_id> --name "Production Env" --file .env.prod
--project (Required): The project ID.
- -n, --name (Required): Name of the secret.
- -k, --key: The secret key (if adding a single value).
- -v, --value: The secret value (if adding a single value).
- -f, --file: Path to a .env file to upload.
edit
Edit the contents of an existing secret.
Usage:
oneguard secrets edit --project <project_id> --id <secret_id> --name "Production Env" --file .env.prod
--project (Required): The project ID.
- --id (Required): The secret ID.
- -n, --name (Required): New name of the secret.
- -k, --key: The secret key.
- -v, --value: The secret value.
- -f, --file: Path to a .env file to overwrite the secret with.
delete
Permanently delete a secret from the vault.
Usage:
archive
Soft-delete (archive) a secret. Archiving hides the secret from being fetched by default without permanently deleting it.
Usage:
set-path
Set the default path on your machine where oneguard env pull will save environment variables.
Usage: