Configuration

age_key_file

• Type: option<path>
• Optional: true
• Since: 0.1.0
• Set with: --age-key-file, FNOX_AGE_KEY_FILE

Path to a file containing the age encryption key.

Prefer setting key_file on the age provider itself, or FNOX_AGE_KEY for inline key content. The --age-key-file flag is deprecated and hidden; the FNOX_AGE_KEY_FILE environment variable remains supported.

Priority (highest to lowest): CLI > Environment > Default

fnox get MY_SECRET --age-key-file ~/.age/key.txt

FNOX_AGE_KEY_FILE=~/.age/key.txt fnox get MY_SECRET

http_timeout

• Type: string
• Default: 30s
• Since: 1.16.0
• Set with: FNOX_HTTP_TIMEOUT

HTTP request timeout for lease backend API calls (Vault, GCP IAM, etc.).

Accepts a duration such as "30s", "2m", or "1h30m". Prevents fnox exec from hanging indefinitely on slow or unreachable servers. Set to "0" to disable the timeout (not recommended). An unparseable value falls back to the default.

Priority: Environment > Default

FNOX_HTTP_TIMEOUT=60s fnox exec -- ./my-app

FNOX_HTTP_TIMEOUT=10s fnox lease create my-lease --duration 1h

if_missing

• Type: option<string>
• Optional: true
• Since: 1.1.0
• Set with: --if-missing, FNOX_IF_MISSING

Runtime override for the if_missing behavior when a secret cannot be resolved.

Available modes: "error" fails the command, "warn" prints a warning and continues, and "ignore" silently skips the missing secret. This overrides any if_missing value set in the configuration.

Priority (highest to lowest): CLI flag > Environment > Secret level > Top-level config > FNOX_IF_MISSING_DEFAULT > Default (warn)

fnox exec --if-missing error -- ./my-app

FNOX_IF_MISSING=ignore fnox exec -- ./my-app

if_missing_default

• Type: option<string>
• Optional: true
• Since: 1.1.0
• Set with: FNOX_IF_MISSING_DEFAULT

Fallback if_missing behavior for secrets that do not set one in the configuration.

Available modes: "error" fails the command, "warn" prints a warning and continues (default), and "ignore" silently skips the missing secret. Unlike FNOX_IF_MISSING, this does not override values set in the configuration.

Priority (highest to lowest): CLI flag > FNOX_IF_MISSING > Secret level > Top-level config > FNOX_IF_MISSING_DEFAULT > Default (warn)

export FNOX_IF_MISSING_DEFAULT=error  # Strict by default

export FNOX_IF_MISSING_DEFAULT=ignore  # Lenient by default

no_defaults

• Type: bool
• Default: false
• Since: 1.12.0
• Set with: --no-defaults, FNOX_NO_DEFAULTS

When a non-default profile is selected, do not merge top-level [secrets] into the profile. Only [profiles.<name>.secrets] will be used.

Priority (highest to lowest): CLI > Environment > Default

fnox exec --profile dev --no-defaults -- ./my-app

FNOX_NO_DEFAULTS=true fnox exec --profile dev -- ./my-app

profile

• Type: list<string>
• Default: default
• Since: 0.1.0
• Set with: --profile, -P, FNOX_PROFILE

Configuration profile to use for secrets retrieval.

Profiles allow you to maintain multiple configurations (e.g., dev, staging, prod) in a single fnox.toml file.

Priority (highest to lowest): CLI > Environment > Default

fnox get MY_SECRET --profile production

FNOX_PROFILE=staging fnox get MY_SECRET

shell_integration_output

• Type: string
• Default: normal
• Since: 0.1.0
• Set with: FNOX_SHELL_OUTPUT

Control how much the shell integration prints when it loads or unloads secrets.

Available modes: "none" prints nothing, "normal" prints a summary when secrets are loaded or unloaded (default), and "debug" prints detailed information, including why the hook exited early.

Priority: Environment > Default

FNOX_SHELL_OUTPUT=none fnox activate bash

FNOX_SHELL_OUTPUT=debug fnox activate zsh

Configuration file reference

This page describes generated runtime settings. For the structure of fnox.toml, see the configuration reference. For authentication and runtime overrides, see environment variables.