---
title: "Secret"
description: "rayfin secret set and secret list manage secrets on a deployed Rayfin item — masked interactive input, names/timestamps only, no bulk .env import."
url: https://rayfin.ai/docs/reference/cli/secret
markdown_url: https://rayfin.ai/docs/reference/cli/secret.md
section: reference
product: Rayfin
sdk_version: 1.34.0
cli_version: 1.33.2
last_updated: 2026-08-23T01:28:43-07:00
source: reference/cli/secret.mdx
---

# Secret

> rayfin secret set and secret list manage secrets on a deployed Rayfin item — masked interactive input, names/timestamps only, no bulk .env import.

`rayfin secret` manages secrets on the Rayfin item you've already deployed with
[`rayfin up`](/docs/reference/cli/up) — API keys, connection strings, and other values your
backend needs but that must never reach client code. See [Secrets](/docs/deploy/secrets) for
the broader workflow and security model; this page is the command reference.

> [!NOTE]
> `rayfin secret` is only registered when `services.functions.enabled: true` in
> `rayfin.yml` (or `RAYFIN_FEATURE_FLAGS` includes `functions`) — the same gate as
> [rayfin functions](/docs/reference/cli/functions).

Both subcommands require a prior deploy — they resolve the target endpoint from
`rayfin/.deployments.json` and fail with "No remote endpoint configured" if you haven't run
`rayfin up` yet. If you aren't signed in, both launch an interactive login automatically,
the same as `rayfin up`.

Neither subcommand declares its own `--json`/`--verbose`/`-y` (unlike most other commands
in this CLI) — pass the [global flags](/docs/reference/cli) on the root invocation instead,
before `secret`: `npx rayfin --json secret list`, not `npx rayfin secret list --json`.

## `secret set` [#secret-set]

```bash
npx rayfin secret set <name>
```

Prompts for the secret's value with masked input (like a password prompt), so the value
never appears in your shell history, in process arguments, or in `--json` output.

| Argument | Description                    |
| -------- | ------------------------------ |
| `<name>` | The name of the secret to set. |

> [!WARNING]
> `secret set` has no non-interactive mode. There is no flag to pass the value directly,
> and it refuses to run without an interactive terminal or when `CI=true` is set — it exits
> with an error rather than hanging. There is currently no CLI-driven way to set a secret
> from an automated CI/CD pipeline; set each value once from an interactive session.

On success:

```text
Setting secret...
✅ Secret "API_KEY" set successfully (updated: 8/23/2026, 6:39:10 AM)
```

With `rayfin --json secret set <name>`, the result is:

```json
{
  "status": "success",
  "name": "API_KEY",
  "createdAt": "2026-08-23T06:39:10.803Z",
  "updatedAt": "2026-08-23T06:39:10.803Z"
}
```

## `secret list` [#secret-list]

```bash
npx rayfin secret list
```

Lists every secret configured on the deployment — names and timestamps only. Secret
**values are never returned** by this or any other command; once set, a secret can only be
overwritten with `secret set`, never read back.

Unlike `secret set`, `secret list` has no interactive-only restriction — it works fine in
CI as long as you're authenticated (for example via the `RAYFIN_TOKEN` ambient-token
variable; see [Login](/docs/reference/cli/login)) and pass `--json`.

> [!NOTE]
> Without `--json`, plain-text output is only printed when stdin is an interactive
> terminal. A non-interactive, non-JSON invocation (for example piped output in a script)
> produces no output at all — pass `rayfin --json secret list` when scripting.

On success (interactive terminal, no `--json`):

```text
📋 Secrets (2):

  Name:         API_KEY
  Created:      8/23/2026, 6:39:10 AM
  Last Updated: 8/23/2026, 6:39:10 AM

  Name:         DATABASE_PASSWORD
  Created:      8/23/2026, 6:40:02 AM
  Last Updated: 8/23/2026, 6:40:02 AM
```

With `rayfin --json secret list`, the result is:

```json
{
  "status": "success",
  "count": 2,
  "secrets": [
    {
      "name": "API_KEY",
      "createdAt": "2026-08-23T06:39:10.803Z",
      "updatedAt": "2026-08-23T06:39:10.803Z"
    },
    {
      "name": "DATABASE_PASSWORD",
      "createdAt": "2026-08-23T06:40:02.100Z",
      "updatedAt": "2026-08-23T06:40:02.100Z"
    }
  ]
}
```

```prompt title="Set and verify a secret on a deployed Rayfin item"
My Rayfin project is already deployed with `npx rayfin up`. Run `npx rayfin secret set
STRIPE_API_KEY`, enter the value when prompted, then run `npx rayfin --json secret list` to
confirm it was set. Never print or log the secret value itself — only report the name and
timestamps.
```