fnox set

• Usage: fnox set [FLAGS] <KEY> [VALUE]
• Aliases: s

Store a secret and add it to the config

Stores the value with a provider and records KEY in the config file in the current directory, or the global config with --global. With an encryption provider such as age, the ciphertext goes in the config. With a remote provider such as 1Password or AWS Secrets Manager, the value is written to the provider and the config records its key there. With no provider, the value is stored in plain text.

The provider is --provider, else the secret's current provider, else default_provider. When you omit VALUE, fnox reads piped stdin (trimming surrounding whitespace) or prompts with hidden input. --from-file reads a file verbatim, including trailing newlines. Passing only --description, --default, or --if-missing updates those settings without asking for a value.

Arguments

• <KEY> — Secret name, used as the environment variable name

• [VALUE] — Value to store; omit to read stdin or prompt

  A value passed as an argument appears in shell history and process listings. Prefer stdin or the prompt for sensitive values.

Flags

• -d --description <DESCRIPTION> — Description to record with the secret

• -g --global — Write to the global config file (~/.config/fnox/config.toml)

• -k --key-name <KEY_NAME> — Name to store the value under at a remote provider (default: KEY)

• -n --dry-run — Show what would be written without storing anything

• -p --provider <PROVIDER> — Provider to store the value with (default: the secret's current provider, then default_provider)

• --base64-encode — Base64-encode the value before storing it

• --default <DEFAULT> — Fallback value to use when the secret cannot be resolved

• --force — Replace an existing secret when generating

• --from-file <FROM_FILE> — Read the value from a UTF-8 file, verbatim

• --generate — Generate a random value instead of reading one

  Uses the OS random number generator. The value is stored through the normal provider path and is not printed unless you pass --show. Refuses to replace an existing secret unless you pass --force.

• --generate-type <GENERATE_TYPE> — Kind of value --generate creates

  Choices: password, hex, base64, uuid

  Default: password

• --if-missing <IF_MISSING> — What to do when the secret cannot be resolved: error, warn, or ignore

  Choices: error, warn, ignore

• --length <LENGTH> — Length in characters of a generated value (default: 32; ignored for uuid; base64 cannot be 1 more than a multiple of 4)

• --show — Print the generated value after storing it

• -h --help — Print help

Examples

Prompt for a value with hidden input

fnox set DATABASE_URL

Store a value with a specific provider

fnox set API_TOKEN --provider op

Store a file's contents verbatim

fnox set SSH_KEY --from-file ~/.ssh/id_ed25519

Read the value from stdin

printf '%s' "$TOKEN" | fnox set API_TOKEN

Generate and store a random value

fnox set API_TOKEN --generate --length 48

Write to the staging profile

fnox -P staging set DATABASE_URL

See also

• Quick start
• Configuration reference