> ## Documentation Index
> Fetch the complete documentation index at: https://sitectl.libops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# secrets

> Inspect, generate, and rotate Compose-declared filesystem or Vault-backed secrets.

List the active site's declared secret references before generating missing
values or rotating one value:

```bash theme={null}
sitectl secrets list
sitectl secrets generate
sitectl secrets rotate APP_DB_PASSWORD
```

Filesystem-backed values live under the site's configured secrets directory.
Vault-backed values are piped to the Vault CLI over stdin and are not copied
into the project directory. Rotation changes stored material; restart or deploy
the consumers that need to reopen their secret files, then run healthcheck and
application verification.

## Reference

Inspect and manage the active site's Compose-declared secrets.

Filesystem secrets default to ./secrets beneath the project directory. A site can map
individual names to Vault in .sitectl/secrets.yaml; Vault values are written through the
Vault CLI over stdin and are never materialized on the site filesystem by sitectl.

```bash theme={null}
sitectl secrets <command>
```

### `secrets list`

Show declared secrets and whether their backing values exist

```bash theme={null}
sitectl secrets list
```

### `secrets generate`

Generate values for missing Compose secrets

```bash theme={null}
sitectl secrets generate
```

### `secrets rotate`

Replace one secret with a newly generated value

```bash theme={null}
sitectl secrets rotate NAME
```