Environment secrets
Organisation owners and administrators can set or replace an encrypted secret for an Aient environment. The command never returns the secret value. Update to Aient CLI 0.7.0, then sign in again so the browser consent flow can request the separate secret-write permission:Set a secret
Pass the value through standard input so it does not appear in shell history or process listings:--environment accepts the environment slug or ID. Secret names must begin with a letter or underscore and may contain letters, numbers, and underscores. PATH, HOME, SHELL, and NODE_OPTIONS are reserved, as are names beginning with AIENT_, GLIMT_, E2E_, DOCKER_, or COMPOSE_.
Values must be valid UTF-8 and no larger than 10,000 bytes. --stdin removes one trailing line ending so a line-oriented pipe does not change the stored value.
You can pass a value as the final positional argument, but that value can be retained by shell history or visible to local process inspection. Use --stdin unless a controlled automation environment requires another input method.
Access and delivery boundaries
- Aient checks the current organisation and owner or administrator role for every write. An environment selector is resolved only within that organisation.
- A successful command reports only the environment and secret name. Aient encrypts the value at rest and does not return it.
- Setting a secret is separate from enabling customer CLI workloads and deciding which environment capabilities are available inside those sandboxes.
- Secret values can still be exposed by an authorised command that deliberately prints them. Keep
env,printenv, shell tracing, terminal capture, and build logs away from secret-bearing commands.