# ry secrets

> Manage app secrets.

```text
ry secrets [options] [command]
```

## Subcommands

### `ry secrets set`

Set secrets (KEY=VALUE ...), staged by default.

```text
ry secrets set [options] <app> <pairs...>
```

Options:

- `--now`: Apply right away: rolling restart, and this command waits for it.
- `--build`: Also give these secrets to the build (default: only NEXT_PUBLIC_*, VITE_*, PUBLIC_* and similar).
- `--no-build`: Keep these secrets out of the build, runtime only.

Example:

```bash
ry secrets set web API_KEY=example-value
ry secrets set web NEXT_PUBLIC_SITE_URL=https://www.example.com --build
ry secrets set web DATABASE_PASSWORD=example-value --now
```

### `ry secrets list`

List secret keys with metadata (never values).

```text
ry secrets list [options] [app]
```

Arguments:

- `[app]`: The app (default: "app" from rytiv.json in this directory or above).

Example:

```bash
ry secrets list web
```

### `ry secrets unset`

Remove a single secret (rejected for managed secrets, e.g. one an attachment injected).

```text
ry secrets unset [options] <app> <key>
```

Example:

```bash
ry secrets unset web API_KEY
```