Use secrets

Store a value once with secret:set. A task reads it by name, so it is never in your code or on the command line.

1 · Name the secret in task.yaml

Use capital letters, digits and underscores, starting with a letter.

secrets: [DB_PASSWORD]

2 · Store the value from stdin

--stdin reads the value from a file or a pipe, so it stays out of your shell history.

$ ignitify secret:set DB_PASSWORD --stdin < db-password.txt✓ secret DB_PASSWORD stored

3 · Read it in your task

The run gets the secrets you named in ctx.secrets, keyed by name.

export async function run(_payload, ctx) {
  const password = ctx.secrets.DB_PASSWORD;
  // connect to your database with it
  return { ok: true };
}

4 · List the names

secret:list shows names and update times. A value can never be read back.

$ ignitify secret:listDB_PASSWORD    2026-10-14T18:50:56.580Z

5 · Delete one

secret:delete asks first; -y skips the question.

$ ignitify secret:delete DB_PASSWORD -yWill delete secret DB_PASSWORD. Its value cannot be read back.✓ secret DB_PASSWORD removed