gh-secret

gh secret command [options]

gh secret manages encrypted secrets for GitHub Actions, Codespaces, and Dependabot. Secrets are encrypted and only exposed to workflows at runtime, providing secure credential storage for CI/CD pipelines.The command supports repository, organization, environment, and user-level secrets. Organization secrets can be scoped to specific repositories via --visibility and --repos. Values are encrypted before transmission and storage. The --app flag selects which application the secret is for (actions, codespaces, or dependabot).

list

List secrets.

Create or update a secret.

Delete a secret.

Target organization secrets.

Target environment secrets.

Target application: actions, codespaces, or dependabot.

Provide the secret value directly (reads from stdin if omitted).

Import secret names and values from a dotenv-formatted file.

Secret visibility for org secrets (all, private, selected). Default: private.

Repositories for selected visibility.

Set or list a secret for your user (Codespaces).

Target a specific repository.

Output the encrypted, base64-encoded value without storing on GitHub.

Display help information.

Secrets are write-only; values cannot be retrieved. Admin access required for org secrets. Secret names are case-insensitive.

gh secret was added to the GitHub CLI to support GitHub Actions secret management, critical for secure CI/CD workflows.

gh(1), gh-secret-set(1), gh-variable(1), gh-run(1)