Skip to main content
List the active site’s declared secret references before generating missing values or rotating one value:
Filesystem-backed values live under the site’s configured secrets directory. Vault-backed values are piped to the Vault CLI over stdin and are not copied into the project directory. Rotation changes stored material; restart or deploy the consumers that need to reopen their secret files, then run healthcheck and application verification.

​
Reference

Inspect and manage the active site’s Compose-declared secrets. Filesystem secrets default to ./secrets beneath the project directory. A site can map individual names to Vault in .sitectl/secrets.yaml; Vault values are written through the Vault CLI over stdin and are never materialized on the site filesystem by sitectl.

​
secrets list

Show declared secrets and whether their backing values exist

​
secrets generate

Generate values for missing Compose secrets

​
secrets rotate

Replace one secret with a newly generated value