> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devhelm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# secrets

> DevHelm CLI secrets commands — list, set, and delete vault secrets

Manage vault secrets from the command line. Store credentials for authenticated monitor checks and use them in config-as-code with `${SECRET_NAME}` syntax.

## Commands

| Command                        | Description                                      |
| ------------------------------ | ------------------------------------------------ |
| `devhelm secrets list`         | List all secrets (names only, values are hidden) |
| `devhelm secrets create`       | Create a new secret                              |
| `devhelm secrets update <key>` | Update a secret's value                          |
| `devhelm secrets delete <key>` | Delete a secret                                  |

<Note>
  Secrets are identified by **key** (e.g., `SLACK_WEBHOOK_URL`). Secret values are write-only — you can set and delete them, but never read the plaintext value back.
</Note>

## secrets list

```bash theme={null}
devhelm secrets list
```

Lists secret names and metadata. Values are never displayed.

## secrets create

```bash theme={null}
devhelm secrets create \
  --key SLACK_WEBHOOK_URL \
  --value "https://hooks.slack.com/services/T00/B00/xxx"
```

| Flag      | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `--key`   | string | Yes      | Secret name  |
| `--value` | string | Yes      | Secret value |

<Note>
  Environment scoping for secrets is supported in the API and the YAML file format ([see YAML reference](/mac/yaml/tags-and-secrets#secrets)), but the CLI `secrets create` command does not yet expose an `--environment` flag. To create environment-scoped secrets from a config-as-code workflow, define them in `devhelm.yml` and run `devhelm deploy`.
</Note>

## secrets update

Update an existing secret's value:

```bash theme={null}
devhelm secrets update SLACK_WEBHOOK_URL \
  --value "https://hooks.slack.com/services/T00/B00/new"
```

| Flag      | Type   | Required | Description      |
| --------- | ------ | -------- | ---------------- |
| `--value` | string | Yes      | New secret value |

## secrets delete

Prompts for confirmation; pass `--yes` (`-y`) in scripts and CI.

```bash theme={null}
devhelm secrets delete SLACK_WEBHOOK_URL
```

## Using secrets in config

Reference secrets in your `devhelm.yml` with `${...}` syntax:

```yaml theme={null}
alertChannels:
  - name: Slack Alerts
    config:
      channelType: slack
      webhookUrl: ${SLACK_WEBHOOK_URL}
```

Secrets are resolved at deploy time. The plaintext value is never stored in your config file.

## Next steps

<CardGroup cols={2}>
  <Card title="Environments" icon="layer-group" href="/cli/commands/environments">
    Create environments for secret scoping.
  </Card>

  <Card title="Monitoring as Code" icon="file-code" href="/guides/monitoring-as-code">
    Use secrets in your YAML config.
  </Card>
</CardGroup>