> ## Documentation Index
> Fetch the complete documentation index at: https://keyflare.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Secrets

> Store and retrieve secrets

Secrets are key-value pairs stored per environment. Both keys and values are encrypted at rest with AES-256-GCM.

# Set Secrets

## Single Secret

```bash theme={null}
kfl secrets set DATABASE_URL=postgres://user:pass@host:5432/db \
  --project my-api \
  --env production
```

## Multiple Secrets

```bash theme={null}
kfl secrets set \
  DATABASE_URL=postgres://... \
  REDIS_URL=redis://... \
  API_SECRET=sk_live_... \
  --project my-api \
  --env production
```

## Upload from .env File

Upload an entire `.env` file. **This is a full override** — all existing secrets are replaced.

```bash theme={null}
kfl secrets upload .env.production --project my-api --env production
```

<Warning>
  Upload replaces ALL secrets in the target environment. You'll be prompted to confirm.
</Warning>

The file is parsed as a standard `.env` file:

```env theme={null}
# Comments are ignored
DATABASE_URL=postgres://user:pass@host:5432/db
REDIS_URL=redis://localhost:6379

# Multiline values with quotes
PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"
```

# Get Secrets

## Single Secret

```bash theme={null}
kfl secrets get DATABASE_URL --project my-api --env production
# postgres://user:pass@host:5432/db
```

## All Secrets (List)

```bash theme={null}
kfl secrets list --project my-api --env production
```

Output:

```text theme={null}
KEY                VALUE
DATABASE_URL       ****
REDIS_URL          ****
API_SECRET         ****
STRIPE_KEY         ****
```

# Delete Secrets

```bash theme={null}
kfl secrets delete OLD_KEY --project my-api --env production
```

# Using Defaults

Set default project and environment in your config:

```yaml theme={null}
# ~/.config/keyflare/config.yaml
api_url: "https://keyflare.account.workers.dev"
project: "my-api"
environment: "development"
```

Then you can omit those flags:

```bash theme={null}
# Uses defaults from config
kfl secrets set DATABASE_URL=postgres://...

# Uses defaults for runtime injection
kfl run -- npm run dev
```

<h2 noAnchor>Next Steps</h2>

<CardGroup cols={2}>
  <Card href="/guides/using-secrets" title="Using Secrets">
    Inject Secrets into runtimes.
  </Card>

  <Card href="/guides/api-keys" title="API Keys">
    Create scoped keys for CI/CD and services.
  </Card>
</CardGroup>