Credentials command#

Usage:
  zyn credentials [command]

Commands:
  edit           edit a credential profile
  get            read a credential value
  rotate master  rotate a profile master key
  schema         list declared credential paths
  set            set a credential value
  unset          remove a credential value

Alias: zyn creds

Inspect credential declarations or manage encrypted profile values.

Example:
  zyn credentials schema

Documentation: zyn docs cli/credentials

zyn creds schema                                  # List declared paths
zyn creds edit -p development                      # Edit a profile
zyn creds get stripe.secret_key -p development     # Print one value
zyn creds set stripe.secret_key -p development     # Enter a masked value
zyn creds unset stripe.secret_key -p development   # Remove a profile value

zyn creds is an alias for zyn credentials. Profile operations require -p PROFILE or --profile PROFILE; schema takes no profile or other options. Use zyn credentials COMMAND --help for one operation's syntax.

Set and read values#

Pass non-secret values directly. Pipe secrets to keep them out of process arguments and shell history:

zyn creds set stripe.publishable_key pk_test_123 -p development
printf '%s' "$STRIPE_SECRET_KEY" | zyn creds set stripe.secret_key -p development

Without a value, set reads a masked line from a terminal or reads redirected input through EOF. Redirected input loses one trailing LF or CRLF; other whitespace is preserved. Empty values are invalid.

A new path is declared .private in credentials/schema.zon. Existing visibility is unchanged. unset removes the profile value, not its declaration. Saving an empty string in the editor also unsets the value.

get prints the exact secret without a label or added newline. Redirect stdout when it must not appear on a terminal. Missing profiles and paths fail without stdout output; diagnostics go to stderr. Reads do not prompt or create profiles. schema lists paths and visibility, not values.

Edit a profile#

edit creates a missing profile and opens decrypted values in $VISUAL, then $EDITOR. Saves are validated against the schema. Unchanged paths and values leave the encrypted file untouched; formatting and comments do not count as changes. Schema and profile updates recover together after interruption and do not silently overwrite concurrent edits.

Automation#

--no-input rejects editors and terminal prompts; explicit and piped values still work:

printf '%s' "$TOKEN" | zyn creds set service.token -p production --no-input

Keep PATH immediately after get, set, or unset. After set PATH, --profile, -p, and --no-input are option tokens; pipe those exact strings to store them as values. Other flag-looking values remain literal.

Profiles and rotation#

dev and prod alias development and production; files use canonical names. Profile names and path components use lowercase snake_case. schema is reserved.

zyn creds rotate master -p production

Stop HTTP processes and workers before rotation. Deploy the matching private key, encrypted profile, and encrypted data-key file together. Rotation replaces the master key but retains the database data key; protected cookies become invalid. Retain the previous matched files outside the repository while backups need them. Missing or invalid data-key files prevent rotation without replacing profile files. Data-key rotation is not supported.

Commit encrypted profile and data-key files, not private keys (except the shared test.key). Never package the whole credentials directory. See Credentials for profile files, packaging, and input rules.