> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aient.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment secrets

> Set or replace encrypted secrets for an Aient environment with the CLI.

# Environment secrets

Organisation owners and administrators can set or replace an encrypted secret for an Aient environment. The command never returns the secret value.

Update to Aient CLI 0.7.0, then sign in again so the browser consent flow can request the separate secret-write permission:

```sh theme={"theme":{"light":"github-light","dark":"github-dark"}}
aient auth login --profile client-a
```

## Set a secret

Pass the value through standard input so it does not appear in shell history or process listings:

```sh theme={"theme":{"light":"github-light","dark":"github-dark"}}
printf '%s' "$STRIPE_SECRET_KEY" |
  aient --profile client-a environment secrets set \
    --environment development \
    STRIPE_SECRET_KEY \
    --stdin
```

`--environment` accepts the environment slug or ID. Secret names must begin with a letter or underscore and may contain letters, numbers, and underscores. `PATH`, `HOME`, `SHELL`, and `NODE_OPTIONS` are reserved, as are names beginning with `AIENT_`, `GLIMT_`, `E2E_`, `DOCKER_`, or `COMPOSE_`.

Values must be valid UTF-8 and no larger than 10,000 bytes. `--stdin` removes one trailing line ending so a line-oriented pipe does not change the stored value.

You can pass a value as the final positional argument, but that value can be retained by shell history or visible to local process inspection. Use `--stdin` unless a controlled automation environment requires another input method.

## Access and delivery boundaries

* Aient checks the current organisation and owner or administrator role for every write. An environment selector is resolved only within that organisation.
* A successful command reports only the environment and secret name. Aient encrypts the value at rest and does not return it.
* Setting a secret is separate from enabling customer CLI workloads and deciding which environment capabilities are available inside those sandboxes.
* Secret values can still be exposed by an authorised command that deliberately prints them. Keep `env`, `printenv`, shell tracing, terminal capture, and build logs away from secret-bearing commands.

The command replaces the named secret atomically. Re-run it with the same name when you need to rotate a value.

## Troubleshooting

| Error                   | What to do                                                                                      |
| ----------------------- | ----------------------------------------------------------------------------------------------- |
| `insufficient scope`    | Sign in again with the selected profile to approve the secret-write permission.                 |
| `insufficient role`     | Ask a current organisation owner or administrator to set the secret.                            |
| `environment not found` | Check the selected profile and confirm the environment slug or ID belongs to that organisation. |
| `invalid request`       | Check the name restrictions and provide a non-empty UTF-8 value no larger than 10,000 bytes.    |