rayfin secret

Command reference for setting, listing, deleting, describing, bulk importing, and typing Rayfin secrets for Functions.

rayfin secret manages secret values stored on the deployed Fabric app. Functions read declared secrets through typed ctx.Secrets.<NAME> properties.

`rayfin secret set`

npx rayfin secret set [name] [--describe="description"] [--stdin]
npx rayfin secret set --env-file <path>

Argument or option	Description
`[name]`	Secret name for a single-secret set. Required unless `--env-file` is used.
`--describe [description]`	Description for this secret in `rayfin/rayfin.yml`; must use equals syntax: `--describe="My description"`.
`--stdin`	Read one secret value from stdin instead of prompting.
`--env-file <path>`	Set multiple secrets from a dotenv file.

For a single secret without --stdin, the CLI prompts with masked input. With --describe, only metadata is written to rayfin.yml:

rayfin/rayfin.yml

secrets:
  - name: OPENAI_KEY
    description: OpenAI API key for summarizeText

The secret value is never written to rayfin.yml.

After a successful single-secret set, the CLI updates rayfin/functions/src/secrets.generated.ts when a functions package exists.

Example interactive success output:

✅ Secret "OPENAI_KEY" set successfully (updated: 10/3/2026, 4:10:00 PM)

Example JSON output:

{
  "status": "success",
  "name": "OPENAI_KEY",
  "createdAt": "2026-10-03T23:10:00.000Z",
  "updatedAt": "2026-10-03T23:10:00.000Z"
}

`rayfin secret list`

npx rayfin secret list
npx rayfin --json secret list

Lists secret names and timestamps only. Values are never returned.

Example interactive output:

📋 Secrets (2):

  Name:         OPENAI_KEY
  Created:      10/3/2026, 4:10:00 PM
  Last Updated: 10/3/2026, 4:10:00 PM

  Name:         DATABASE_PASSWORD
  Created:      10/3/2026, 4:12:00 PM
  Last Updated: 10/3/2026, 4:12:00 PM

Example JSON output:

{
  "status": "success",
  "count": 2,
  "secrets": [
    {
      "name": "OPENAI_KEY",
      "createdAt": "2026-10-03T23:10:00.000Z",
      "updatedAt": "2026-10-03T23:10:00.000Z"
    },
    {
      "name": "DATABASE_PASSWORD",
      "createdAt": "2026-10-03T23:12:00.000Z",
      "updatedAt": "2026-10-03T23:12:00.000Z"
    }
  ]
}

When scripting, use --json. Plain text is intended for interactive terminals.

`rayfin secret delete`

npx rayfin secret delete <name>
npx rayfin secret delete <name> --yes

Argument or option	Description
`<name>`	Secret to delete.
`-y, --yes`	Skip the confirmation prompt.

Delete removes the remote value, removes the metadata entry from rayfin.yml, and regenerates secrets.generated.ts.

Dotenv import rules

--env-file reads KEY=VALUE entries. Blank lines and # comments are ignored. Surrounding single or double quotes are stripped from values. Names are used verbatim; there is no prefix convention.

rayfin/.env.secrets

OPENAI_KEY=sk-authoring-value
DATABASE_PASSWORD='quoted-value'

Do not commit dotenv files that contain secrets.

Output and global flags

Use root/global flags before or after the command as supported by Commander:

npx rayfin --json secret list
npx rayfin secret set OPENAI_KEY --stdin --json

secret list, secret set, and secret delete emit JSON envelopes when --json is set.

Errors

Error text	Cause
`❌ --describe requires the = syntax: --describe="My description"`	`--describe` was passed without equals syntax.
`❌ --stdin and --env-file cannot be used together`	Choose one input source.
`❌ Do not pass <name> with --env-file`	Bulk import uses names from the file.
`❌ Secret name is required when using --stdin`	Pass `rayfin secret set <NAME> --stdin`.
`❌ Secret name is required`	Pass a name or `--env-file`.
`❌ No remote endpoint configured`	Run `npx rayfin up` first.
`❌ Env file not found: <path>`	Fix the dotenv file path.
`❌ No KEY=VALUE entries found in <path>`	Add at least one dotenv entry.
`No secret value was provided on stdin.`	Stdin was empty or whitespace.
`❌ Secret "<name>" was not found. It may already be deleted, or secret management may not be enabled for this item.`	The remote endpoint returned 404 for delete.

PromptManage Rayfin secrets with the CLI

In my Rayfin project, manage a secret named <NAME> with `rayfin secret`.

Confirm the app has an active deployment. Set the secret using `npx rayfin secret set <NAME> --describe="<purpose>"` or, for automation, `printf '%s' "$VALUE" | npx rayfin secret set <NAME> --stdin`. Never print or store the secret value. Verify with `npx rayfin --json secret list`. If I ask to remove it, run `npx rayfin secret delete <NAME> --yes` and confirm rayfin/rayfin.yml and rayfin/functions/src/secrets.generated.ts no longer advertise it.

Something wrong on this page?Report an issueEdit this page

rayfin secret

rayfin secret set

rayfin secret list