Secrets, Vault, and Variables

Use this page when you need to pick the right storage layer for sensitive or non-sensitive configuration.

Choose the layer

Layer	Command	Best for
Encrypted secrets	`tc secrets`	API keys, passwords, tokens
Encrypted vault data	`tc vault`	Low-level encrypted key paths
Plaintext variables	`tc vars`	URLs, feature flags, log levels

`tc secrets`

tc secrets network init
tc secrets network show
tc secrets doctor
tc secrets put STRIPE_KEY "sk_live_..."
tc secrets get STRIPE_KEY
tc secrets list
tc secrets delete STRIPE_KEY
tc secrets manage

tc secrets stores values in the literal secrets space by default and supports logical scopes with --scope.

tc secrets put DATABASE_URL "postgres://..." --scope prod
tc secrets get DATABASE_URL --scope prod
tc secrets list --scope prod

You can also target another owned space with --space.

Match an app manifest

An app manifest’s secrets field and tc secrets address the same encrypted vault entries when their names and scopes match:

Manifest declaration	CLI command	Backing path in the `secrets` space
`"API_KEY": ["read"]`	`tc secrets put API_KEY "..."`	`vault/secrets/API_KEY`
`"API_KEY": { "scope": "my-app", "actions": ["read"] }`	`tc secrets put API_KEY "..." --scope my-app`	`vault/secrets/scoped/my-app/API_KEY`

A scoped secret is a separate entry from a global secret with the same name; TinyCloud does not fall back from one to the other. The manifest declares the access an app requests during sign-in, while the CLI or SDK writes the value. See the complete app manifest and resolved path mapping for a copyable browser-app example.

`tc vault`

tc vault is the lower-level encrypted KV layer. It requires a private key.

tc vault unlock --private-key 0x...
tc vault put my-app/api-key "sk_live_..."
tc vault get my-app/api-key
tc vault list
tc vault head my-app/api-key
tc vault delete my-app/api-key

`tc vars`

tc vars stores plaintext configuration in the variables/ prefix and also requires a private key.

tc vars put API_BASE_URL "https://api.example.com"
tc vars get API_BASE_URL
tc vars list
tc vars delete API_BASE_URL

Private keys

Use TC_PRIVATE_KEY or --private-key for vault and vars. secrets can use the active authenticated profile, but it also accepts a private key override.

The CLI source treats tc secrets network init as the way to create or reuse the default secrets encryption network, and tc secrets doctor as the quickest access check.

CLI

Hosting

OpenKey

Support

Secrets, Vault, and Variables

Choose the layer

`tc secrets`

Match an app manifest

`tc vault`

`tc vars`

Private keys

​Choose the layer

​tc secrets

​Match an app manifest

​tc vault

​tc vars

​Private keys

Choose the layer

`tc secrets`

Match an app manifest

`tc vault`

`tc vars`

Private keys