--- title: Secrets and env files description: List and set the variables of a secret group, rotate it, and pull its text values into a local env file. order: 5 --- A secret group holds a service's variables. Each variable is a **secret**, whose value is never shown again once saved, or **text**, whose value can be read back. ## List ```sh ops secrets list api ops secrets list api --env staging ``` Each variable's name, kind, whether it has a value, its version and whether a change is waiting to be rendered. A value is shown for text variables only. ## Set ```sh ops secrets set api STRIPE_KEY=sk_live_... # a secret ops secrets set api LOG_FORMAT=json --text # a text variable ``` A name is `A` to `Z`, `0` to `9` and `_`, starting with a letter, and is checked before anything is sent. The value is split at the first `=`, so it may hold more. The command prints the name and the group, never the value. `--group api` works in place of the positional group name. The kind is decided when the variable is created. Setting an existing variable again changes its value and keeps its kind. ## Rotate ```sh ops secrets rotate api ``` Renders the group again and restarts the services that mount it. It prints the new secret version, the services it restarted and any it skipped, with the reason. ## Pull an env file ```sh ops env pull # to stdout ops env pull -o # to .env ops env pull -o .env.local --group api --env staging ``` Text variables are written as `NAME=value`. **Secret values are never exported**, anywhere: each secret becomes a comment saying it is rendered into the container at deploy time, so the file is a starting point, not a runnable copy of production. `--fail-on-secrets` makes the command fail when the group holds any secret. `--group` may be left out while the environment has a single secret group. With several, the command names them and asks you to choose. A database's connection is a secret, so a pulled file names it and holds none of it. Point your own `DATABASE_URL` at a local database.