> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinycloud.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets, Vault, and Variables

> Manage encrypted secrets, encrypted vault data, and plaintext variables

Use this page when you need to pick the right storage layer for sensitive or non-sensitive configuration.

## Choose the layer

| Layer                | Command      | Best for                        |
| -------------------- | ------------ | ------------------------------- |
| Encrypted secrets    | `tc secrets` | API keys, passwords, tokens     |
| Encrypted vault data | `tc vault`   | Low-level encrypted key paths   |
| Plaintext variables  | `tc vars`    | URLs, feature flags, log levels |

## `tc secrets`

```bash theme={null}
tc secrets network init
tc secrets network show
tc secrets doctor
tc secrets put STRIPE_KEY "sk_live_..."
tc secrets get STRIPE_KEY
tc secrets list
tc secrets delete STRIPE_KEY
tc secrets manage
```

`tc secrets` stores values in the literal `secrets` space by default and supports logical scopes with `--scope`.

```bash theme={null}
tc secrets put DATABASE_URL "postgres://..." --scope prod
tc secrets get DATABASE_URL --scope prod
tc secrets list --scope prod
```

You can also target another owned space with `--space`.

## `tc vault`

`tc vault` is the lower-level encrypted KV layer. It requires a private key.

```bash theme={null}
tc vault unlock --private-key 0x...
tc vault put my-app/api-key "sk_live_..."
tc vault get my-app/api-key
tc vault list
tc vault head my-app/api-key
tc vault delete my-app/api-key
```

## `tc vars`

`tc vars` stores plaintext configuration in the `variables/` prefix and also requires a private key.

```bash theme={null}
tc vars put API_BASE_URL "https://api.example.com"
tc vars get API_BASE_URL
tc vars list
tc vars delete API_BASE_URL
```

## Private keys

Use `TC_PRIVATE_KEY` or `--private-key` for `vault` and `vars`. `secrets` can use the active authenticated profile, but it also accepts a private key override.

<Note>
  The CLI source treats `tc secrets network init` as the way to create or reuse the default secrets encryption network, and `tc secrets doctor` as the quickest access check.
</Note>