sinch secrets

Store and retrieve custom secrets in the OS keychain. Secrets are available to your functions at runtime and during deploy — the CLI injects them from the keychain so you never put secret values in source files.

Secrets are stored under the sinch-cli service in the OS keychain with a custom- prefix. Key names must be uppercase letters, numbers, and underscores only (e.g., API_KEY, DATABASE_PASSWORD).

List all custom secrets by key name. Values are not shown.

sinch secrets list

Add or update a secret in the OS keychain. If the key already exists, the value is updated.

sinch secrets add <KEY> <VALUE> [--json]

With --json it prints { "key", "updated", "env" }, where env is added, present, has-value or no-env. The value is never printed.

When run from a function directory (one containing an .env file), the command also appends KEY= to .env for you — that empty placeholder is what tells the deploy step to substitute the keychain value at upload time. If .env already declares the key, the existing line is left as is. If the line already has a non-empty value, the .env value wins over the keychain at deploy — clear it (KEY=) if you want the keychain value used instead.

If there is no .env in the current directory (e.g. running the command globally), only the keychain is updated; declare the key manually in your function's .env for it to ship. If the function's .env is missing entirely, sinch env init scaffolds a new one.

Retrieve a secret from the keychain. The value is hidden by default.

sinch secrets get <KEY> [--show] [--json]

With --json it prints { "key", "exists": true, "length" }. Only with --show does it print { "key", "value" }.

Remove a secret from the keychain. Requires confirmation unless --force is passed.

Aliases: remove, rm

sinch secrets delete <KEY> [-f, --force] [--json]

With --json it prints { "id", "deleted": true } and never prompts. Without --force or --non-interactive it fails with an error naming --force.

Remove all custom secrets from the keychain. Requires confirmation unless --force is passed.

sinch secrets clear [-f, --force] [--json]

With --json it prints { "deleted": <count> } and requires --force whenever there is something to delete.