Secret

rayfin secret manages secrets on the Rayfin item you've already deployed with rayfin up — API keys, connection strings, and other values your backend needs but that must never reach client code. See Secrets for the broader workflow and security model; this page is the command reference.

Both subcommands require a prior deploy — they resolve the target endpoint from rayfin/.deployments.json and fail with "No remote endpoint configured" if you haven't run rayfin up yet. If you aren't signed in, both launch an interactive login automatically, the same as rayfin up.

Neither subcommand declares its own --json/--verbose/-y (unlike most other commands in this CLI) — pass the global flags on the root invocation instead, before secret: npx rayfin --json secret list, not npx rayfin secret list --json.

secret set

npx rayfin secret set <name>

Prompts for the secret's value with masked input (like a password prompt), so the value never appears in your shell history, in process arguments, or in --json output.

On success:

Setting secret...
✅ Secret "API_KEY" set successfully (updated: 8/23/2026, 6:39:10 AM)

With rayfin --json secret set <name>, the result is:

{
  "status": "success",
  "name": "API_KEY",
  "createdAt": "2026-08-23T06:39:10.803Z",
  "updatedAt": "2026-08-23T06:39:10.803Z"
}

secret list

npx rayfin secret list

Lists every secret configured on the deployment — names and timestamps only. Secret values are never returned by this or any other command; once set, a secret can only be overwritten with secret set, never read back.

Unlike secret set, secret list has no interactive-only restriction — it works fine in CI as long as you're authenticated (for example via the RAYFIN_TOKEN ambient-token variable; see Login) and pass --json.

On success (interactive terminal, no --json):

📋 Secrets (2):

  Name:         API_KEY
  Created:      8/23/2026, 6:39:10 AM
  Last Updated: 8/23/2026, 6:39:10 AM

  Name:         DATABASE_PASSWORD
  Created:      8/23/2026, 6:40:02 AM
  Last Updated: 8/23/2026, 6:40:02 AM

With rayfin --json secret list, the result is:

{
  "status": "success",
  "count": 2,
  "secrets": [
    {
      "name": "API_KEY",
      "createdAt": "2026-08-23T06:39:10.803Z",
      "updatedAt": "2026-08-23T06:39:10.803Z"
    },
    {
      "name": "DATABASE_PASSWORD",
      "createdAt": "2026-08-23T06:40:02.100Z",
      "updatedAt": "2026-08-23T06:40:02.100Z"
    }
  ]
}