doppler-secrets

doppler secrets [subcommand] [arguments] [flags]

doppler secrets is the read/write interface to the secrets in a Doppler config. Run with no subcommand it prints a table of everything in the config selected by `doppler setup`, with values masked.download is the export path. It defaults to JSON and, without --no-file, writes an *encrypted* fallback file rather than a plaintext one, which is a deliberate safety choice: the usual way to get a plaintext dotenv onto stdout is `doppler secrets download --no-file --format env`.Secrets may reference one another with `${OTHER_SECRET}` syntax, and the CLI resolves those references before printing. --raw shows the stored text instead, which is what you want when copying a value between configs.substitute renders a Go template file with the config's secrets available as variables, which covers the common case of generating a Kubernetes manifest or a config file that expects real values rather than environment variables.

-p, --project NAME / -c, --config NAME

Project and config to act on, overriding whatever `doppler setup` selected for this directory.

Print values with no table formatting. Essential when capturing a value in a script.

Print secret names and omit every value.

Print the raw stored value without resolving secret references.

Copy the value to the clipboard (get).

Output format for download: `json` (the default), `env`, `yaml`, `docker`, and others.

Print the response to stdout instead of writing a file.

Set a secret's visibility on set: `masked`, `unmasked`, or `restricted`.

Proceed without a confirmation prompt (delete).

Control the encrypted fallback file that lets secrets still be read when Doppler is unreachable.

Print the result as JSON.

(none)

Print a table of every secret in the current project and config.

Get the value of one or more secrets.

Set the value of one or more secrets. Called with only a name, it prompts for the value interactively.

Delete one or more secrets.

Download a config's secrets for later use. Without --no-file it writes an *encrypted* fallback file.

Upload a secrets file, importing everything in it.

Substitute secrets into a template file.

Anything printed by get --plain or download --no-file is plaintext on your terminal and in your shell history; prefer `doppler run` so that values never touch disk. download writing an encrypted file by default surprises people who expect a readable `.env`. delete is immediate and there is no undo, though the change is recorded in the activity log. Writes need a token with write access, and read-only service tokens will fail on set and delete.

doppler secrets is the core of the Doppler CLI and dates from the product's first release. The design that stuck, keeping secrets out of `.env` files on disk and injecting them at process start instead, is what the rest of the CLI is built around; the encrypted fallback file was added so that this remained safe when the network or the API is unavailable.

doppler(1), doppler-projects(1), vault(1), sops(1)

Source code · Homepage · Documentation