---
title: Secrets
description: Secret groups hold the variables a service gets when it starts.
order: 4
---

A secret group is a set of variables in one environment. A service names its group as
`env_group`, and gets the group's variables when it starts. Values live in ops and never in
your repository, a spec or the audit log.

## Two kinds of variable

| kind | shown again | use it for |
| --- | --- | --- |
| secret | never, not in the console, the CLI or the API | passwords, keys, tokens |
| text | yes | settings that are not secret, such as a log level |

## Setting variables

Open **Secrets**. Each group is a table you edit in place: **Add variable**, type the name
and the value, and choose its kind. A name is `A` to `Z`, `0` to `9` and `_`, starting with
a letter.

From a terminal:

```sh
ops secrets list api                            # names, kinds, and the text values
ops secrets set api PAYMENT_KEY=...             # a secret
ops secrets set api LOG_LEVEL=debug --text      # a text variable
ops secrets set api LOG_LEVEL=debug --text --env staging
```

## A change reaches the service when you render

Setting a variable does not restart anything. The group shows how many changes wait, and
**Render** writes the next version and restarts the services that mount it.
From a terminal that is:

```sh
ops secrets rotate api
```

The section under the groups lists every version rendered so far.

## Variables ops writes for you

Some variables in a group belong to another resource: a database's connection string, a
bucket's keys, a service's public address. Ops writes them and updates them, and they are
not yours to edit.

## A local env file

`ops env pull` writes the text variables of a group to a file. Secret values are never
exported: each one becomes a commented line naming where its value comes from.

```sh
ops env pull --group api -o .env                  # production
ops env pull --group api --env development -o .env
ops env pull --fail-on-secrets                    # exit 1 when the group holds secrets
```

`--group` may be left out while the environment has one group.