Secrets, Vault, and Variables

Use this page when you need to pick the right storage layer for sensitive or non-sensitive configuration.

Choose the layer

Layer	Command	Best for
Encrypted secrets	`tc secrets`	API keys, passwords, tokens
Encrypted vault data	`tc vault`	Low-level encrypted key paths
Plaintext variables	`tc vars`	URLs, feature flags, log levels

`tc secrets`

tc secrets network init
tc secrets network show
tc secrets doctor
tc secrets put STRIPE_KEY "sk_live_..."
tc secrets get STRIPE_KEY
tc secrets list
tc secrets delete STRIPE_KEY
tc secrets manage

tc secrets stores values in the literal secrets space by default and supports logical scopes with --scope.

tc secrets put DATABASE_URL "postgres://..." --scope prod
tc secrets get DATABASE_URL --scope prod
tc secrets list --scope prod

You can also target another owned space with --space.

`tc vault`

tc vault is the lower-level encrypted KV layer. It requires a private key.

tc vault unlock --private-key 0x...
tc vault put my-app/api-key "sk_live_..."
tc vault get my-app/api-key
tc vault list
tc vault head my-app/api-key
tc vault delete my-app/api-key

`tc vars`

tc vars stores plaintext configuration in the variables/ prefix and also requires a private key.

tc vars put API_BASE_URL "https://api.example.com"
tc vars get API_BASE_URL
tc vars list
tc vars delete API_BASE_URL

Private keys

Use TC_PRIVATE_KEY or --private-key for vault and vars. secrets can use the active authenticated profile, but it also accepts a private key override.

The CLI source treats tc secrets network init as the way to create or reuse the default secrets encryption network, and tc secrets doctor as the quickest access check.

CLI

Hosting

OpenKey

Support

Secrets, Vault, and Variables

Choose the layer

`tc secrets`

`tc vault`

`tc vars`

Private keys

​Choose the layer

​tc secrets

​tc vault

​tc vars

​Private keys

Choose the layer

`tc secrets`

`tc vault`

`tc vars`

Private keys