> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/secrets/current-shell.md). # Use secrets in your current shell Load secrets from your vault into your current Bash or PowerShell session with devo secret shell enter, then restore it with leave. `devo secret run` gives secrets to one command. When you need them for several commands in a row, in the same Bash or PowerShell session, use `devo secret shell enter`. It sets environment variables in your current shell, and `devo secret shell leave` puts them back the way they were. {% hint style="warning" %} After `devo secret shell enter`, the values are in plain text in your shell session. Every program you start from that session inherits them, and your shell history, transcripts, or debugging tools can expose them. Masking doesn't apply. Leave the scope as soon as you're done, and prefer [devo secret run](/cli/guides/secrets/run-with-secrets.md) whenever one command is enough. {% endhint %} ## How it works A program can't change the environment of the shell that started it. So `devo secret shell enter` doesn't set anything itself: it prints a short script for your shell, with the values in it, and you run that script with `eval` (Bash) or `Invoke-Expression` (PowerShell). `--shell` says which kind of script to print: `bash` or `pwsh`. ## Check the references first `--check` runs a value-free read of each reference, without reading any secret and without printing a script. It confirms the syntax and, for a named reference or on a local profile, the vault and the entry, but not that the field can be read: on Devolutions Cloud and Devolutions Server, a canonical reference isn't looked up. It needs JSON output: ```bash devo secret shell enter --shell bash --env-ref DB_PASSWORD= --check --output json ``` ## Enter the scope Repeat `--env-ref NAME=` for each variable. Run the script only if the command succeeded. {% tabs %} {% tab title="Bash" %} ```bash enter="$(devo secret shell enter --shell bash \ --env-ref DB_USER= \ --env-ref DB_PASSWORD=)" && eval "$enter" unset enter ``` {% endtab %} {% tab title="PowerShell" %} ```powershell $enter = & devo secret shell enter --shell pwsh ` --env-ref DB_USER= ` --env-ref DB_PASSWORD= | Out-String if ($LASTEXITCODE -eq 0) { Invoke-Expression $enter } Remove-Variable enter ``` {% endtab %} {% endtabs %} If a reference can't be read, the command prints nothing on its standard output, reports the error, and exits with a non-zero code: your shell stays unchanged. {% hint style="danger" %} `eval` and `Invoke-Expression` run whatever they receive. Pass them only the output of a `devo secret shell enter` or `devo secret shell leave` command that succeeded, and never mix its error output into it. {% endhint %} ## See what's loaded ```bash devo secret shell status --shell bash --output json ``` The status shows whether a scope is active, how many scopes are nested, and the names of the variables set by the most recent scope. It never shows values, and it needs JSON output. ## Leave the scope {% tabs %} {% tab title="Bash" %} ```bash leave="$(devo secret shell leave --shell bash)" && eval "$leave" unset leave ``` {% endtab %} {% tab title="PowerShell" %} ```powershell $leave = & devo secret shell leave --shell pwsh | Out-String if ($LASTEXITCODE -eq 0) { Invoke-Expression $leave } Remove-Variable leave ``` {% endtab %} {% endtabs %} Leaving restores each variable as it was before you entered: its previous value if it had one, or no variable at all if it didn't. ## Nest scopes You can enter a scope while another one is active, for example to add a second set of credentials. Each `devo secret shell leave` closes the most recent scope only, so you leave in the reverse order you entered. ## Good to know * The generated Bash script uses Bash features, so run it in Bash, not in another POSIX shell. For PowerShell, `--shell powershell` works the same as `--shell pwsh`. * Run `devo secret shell status` and `devo secret shell leave` with the same `--shell` value you used to enter. * `devo secret shell enter` doesn't read your environment or `.env` files: list each variable with `--env-ref`. * References resolve through the current context. Add `--context ` to use another workspace. ## Next * [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md) * [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/cli/guides/secrets/current-shell.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.