> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/secrets/update-a-secret.md).

# Update a secret from a script

Write a new password to an entry from a script with devo secret set, reading the value from an environment variable or a file, never the command line.

When a script rotates a password, generates an API key, or receives a new token, it can store the value straight in your vault with `devo secret set`. The new value comes from an environment variable or a file, never from the command line.

## Write the new value

`devo secret set` takes the field, then the entry. Add `--yes` to approve the change: without it, nothing is written.

{% tabs %}
{% tab title="From an environment variable" %}

```bash
devo secret set password "<entry-name>" --value-env NEW_PASSWORD --yes
```

`--value-env` takes the **name** of the variable, not its value.
{% endtab %}

{% tab title="From a file" %}

```bash
devo secret set password "<entry-name>" --value-file <path-to-file> --yes
```

{% endtab %}
{% endtabs %}

Use exactly one of `--value-env` or `--value-file`. To select the entry by ID, write `id:<entry-id>` or add `--id`; `--vault-id` selects the vault. To write to another workspace than the current one, add `--context <context-name>`.

For example, generate a password and store it without ever displaying it:

```bash
NEW_PASSWORD="$(devo generate password)" devo secret set password "<entry-name>" --value-env NEW_PASSWORD --yes
```

## What each workspace type can write

<table><thead><tr><th width="260">WORKSPACE</th><th>FIELDS YOU CAN WRITE</th></tr></thead><tbody><tr><td><strong>Devolutions Server</strong></td><td>Any data property of the entry, such as <code>password</code>, <code>username</code>, <code>domain</code>, or <code>host</code>. Sections aren't supported.</td></tr><tr><td><strong>Devolutions Cloud</strong></td><td><code>password</code> only.</td></tr><tr><td><strong>Local Devolutions Remote Desktop Manager profile</strong></td><td><code>password</code> only, for a workspace protected by a shared passphrase. See below.</td></tr></tbody></table>

Any other field on Devolutions Cloud or a local profile is refused with an error that says the workspace accepts writes to the password field only. `devo secret capabilities --output json` describes these rules for each workspace type. See [Compare workspace types](/cli/guides/understand/workspace-types.md).

### Local profiles: the workspace passphrase

To write to a local profile, Devolutions CLI needs the passphrase of the workspace. By default, it reads it from the file `<workspace file>.passphrase` in the profile folder. To use another source, add `--passphrase-file <path>` or `--passphrase-env <variable-name>`. Without a passphrase, the command stops and says where it looked. These two options are for local profiles only.

See [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md).

## Good to know

* The command never prints the new value. On success, it confirms the update, for example with `Secret: updated`.
* In a pipeline, `--yes` is what makes the write happen; there's no prompt to answer. See [Run without prompts](/cli/for-devops-and-administrators/automate/non-interactive.md).
* The command says the workspace doesn't support the field: see [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## Next

* [Generate passwords and SSH keys](/cli/guides/generate.md)
* [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/secrets/update-a-secret.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.