# CLI secrets

Site secrets are named runtime values read through `ctx.secrets`.

## List metadata

```sh
interfold secrets list --site <site-id>
```

Prefer listing when you only need to verify that a secret exists.

## Set a value

Pipe values through stdin so they do not land in shell history:

```sh
printf '%s' "$OPENAI_API_KEY" |
  interfold secrets set OPENAI_API_KEY --site <site-id>
```

`set` creates or replaces the named secret.

## Retrieve a value

```sh
interfold secrets get OPENAI_API_KEY --site <site-id>
interfold secrets get OPENAI_API_KEY --site <site-id> --raw
```

Retrieval reveals sensitive data and creates an audit-log entry. Use it only
when the task explicitly requires the value.

## Delete

```sh
interfold secrets rm OPENAI_API_KEY --site <site-id>
```

Existing functions or cron jobs may fail until a deleted secret is restored.