> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/secrets.md).

# Use secrets without exposing them

Pick the Devolutions CLI command that gives a secret to your program while exposing as little of the value as possible.

Devolutions CLI can hand a secret from your vault to a program in several ways. They differ in the one thing that matters most: whether the value ever lands somewhere you, your shell, or a file can see it. Start with `devo secret run`, and pick another command only when your tool can't work with it.

## Pick the right command

<table><thead><tr><th width="220">CHOOSE</th><th>WHAT HAPPENS</th><th width="220">VALUE STAYS HIDDEN?</th></tr></thead><tbody><tr><td><code>devo secret run</code></td><td>Resolves references into the environment or the standard input of one command, starts it, and replaces the values with <code>&#x3C;concealed by Devolutions></code> in what it prints.</td><td><strong>Yes.</strong> The values exist only in that command's environment, while it runs.</td></tr><tr><td><code>devo secret inject</code></td><td>Replaces the references in a template and writes the result to a file or to standard output.</td><td><strong>No.</strong> The result contains the values in plain text.</td></tr><tr><td><code>devo secret shell enter</code></td><td>Prints Bash or PowerShell code that sets environment variables in your current shell. You run that code with <code>eval</code> or <code>Invoke-Expression</code>.</td><td><strong>No.</strong> The values stay in plain text in your shell session until you leave the scope.</td></tr><tr><td><code>devo secret read</code></td><td>Resolves one reference and prints the value, or writes it to a private file with <code>--out-file</code>.</td><td><strong>No.</strong> You get the value.</td></tr><tr><td><code>devo secret get</code></td><td>Same as <code>devo secret read</code>, but you name the field and the entry instead of writing a reference.</td><td><strong>No.</strong> You get the value.</td></tr><tr><td><code>devo secret set</code></td><td>Writes a new value to a field of an entry. The value comes from an environment variable or a file.</td><td><strong>Yes.</strong> The new value is never typed on the command line and never printed.</td></tr><tr><td><code>devo secretspec</code></td><td>Registers Devolutions CLI as the provider SecretSpec calls for <code>devo://</code> provider URIs.</td><td><strong>No.</strong> Devolutions CLI returns the value to SecretSpec, which passes it to your application.</td></tr></tbody></table>

{% hint style="warning" %}
`devo secret read`, `devo secret get`, `devo secret inject`, and `devo secret shell enter` hand over the actual value on purpose. Use them only where that's acceptable, and never in the transcript of an AI agent. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).
{% endhint %}

## In this section

* [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md): list the `devo://` references of an entry, without reading any value.
* [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md): `devo secret run`, the safest way to give a secret to a program.
* [Take the passwords out of a .env file](/cli/guides/secrets/replace-env-files.md): keep `.env` files in your repository, with references instead of values.
* [Fill a configuration file from a template](/cli/guides/secrets/fill-a-template.md): `devo secret inject`, for tools that only read a configuration file.
* [Use secrets in your current shell](/cli/guides/secrets/current-shell.md): `devo secret shell enter`, for several commands in a row.
* [Update a secret from a script](/cli/guides/secrets/update-a-secret.md): `devo secret set`, to rotate a password without typing it.
* [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md): make your vault the backend of SecretSpec.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/secrets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.