Vault commands

zero vault … manages projects, environments and secrets. Install the CLI and set up your key first: see Zero CLI.

Projects and environments

Projects start with development and production environments.

zero vault projects create demo
zero vault projects list

zero vault env list -p demo
zero vault env create staging -p demo

Manage secrets

zero vault secrets set API_TOKEN=abc123 -p demo -e development
zero vault secrets list  -p demo -e development     # values shown masked
zero vault secrets get   API_TOKEN -p demo -e development   # prints the value

zero vault secrets set is create-or-update; run it again with the same key to change the value. Set several at once by passing more KEY=VALUE pairs. Delete a secret with:

zero vault secrets delete API_TOKEN -p demo -e development

Run a command with the secrets

zero vault run starts a command with the environment’s secrets and writes no file to disk. Use it instead of downloading a file.

zero vault run -p demo -e production -- node server.js
zero vault run -p demo -e development --mount .dev.vars -- wrangler dev

--mount serves the secrets through a named pipe for tools that read a dotenv file. See Loading secrets.

Download secrets

zero vault secrets download writes an environment’s secrets in the format you ask for (env, json, yaml, or shell), to stdout or a file with -o.

zero vault secrets download -p demo -e development -f env

API_TOKEN=abc123
DB_URL=postgres://localhost

-f shell emits export KEY="VALUE" lines for sourcing into a shell, -f json a flat { "KEY": "VALUE" } object, and -f yaml a KEY: "VALUE" list. See Loading secrets for pulling an environment into a process or CI job.

Back up the whole vault

zero vault export dumps every project and secret across your organization as plaintext JSON, and zero vault import <file> restores it. Because the file is plaintext, delete it as soon as you are done.

zero vault export -o vault-backup.json

Load secrets into a process or CI job.
Pull secrets into a Cloudflare Worker at deploy time.