Help / Managing secrets
Managing secrets
Updated July 15, 2026
A secret is a key and a value scoped to one environment of one project. Keys are uppercase letters, digits and underscores. Every command below acts on your active context, or on whatever you pass with --workspace, --project and --env.
Set and read
set takes a single KEY=VALUE argument and creates the key if it is new, or adds a version if it already exists.
$ bippass set STRIPE_KEY=sk_live_123 ✓ Created STRIPE_KEY
# values are masked unless you ask for them $ bippass ls $ bippass ls --reveal
# print one value, e.g. to pipe somewhere $ bippass get STRIPE_KEY
Every reveal is written to the audit log with who did it and when. That is deliberate — reading a production secret should leave a trace.
Run a command without writing secrets to disk
This is the point of the whole tool. run decrypts your secrets, injects them as environment variables into a child process, and forwards its exit code. Nothing touches the filesystem.
$ bippass run -- npm start $ bippass run --env staging -- ./server
Working with an existing .env
If you already have a .env file, push uploads it (encrypting locally on the way), and pull writes secrets back out to one. diff shows what differs without changing anything, and sync does a three-way merge.
$ bippass push --file .env $ bippass pull --file .env.production $ bippass diff $ bippass sync
pull writes plaintext to disk — that is what a .env file is. Prefer run when you can, and keep the file out of git.
Removing a secret
$ bippass delete STRIPE_KEYHistory and rollback
Changing a value adds a version rather than overwriting — ls shows the current version number. Browsing that history and rolling a secret back is done in the web app, under the project's environment; the CLI does not expose it.