wheels deploy secrets fetch

Fetch one or more named keys from a named adapter. Prints them as KEY=VALUE lines — the format .kamal/secrets accepts via $(...).

The documented form is the flat alias wheels deploy fetch-secrets; wheels deploy secrets fetch is equivalent. Older CLI runtimes intercepted the nested wheels deploy secrets <verb> form in the top-level secrets command (#2697), which is why the flat aliases exist (#2699). On the current runtime the nested form also reaches deploy dispatch.

Synopsis

"

wheels deploy fetch-secrets --adapter=<name> [--account=<acct>] [--from=<scope>] <KEY>...

Flags

Flag	Description
--adapter=<name>	Required. One of op, 1password, bw, bitwarden, aws, lpass, lastpass, doppler. Unknown names throw DeploySecretsCli.UnknownAdapter.
--account=<acct>	Adapter-specific account selector.
--from=<scope>	Adapter-specific scope — e.g. op://Vault/Item for 1Password, a prefix path for Doppler.
<KEY>...	One or more keys to fetch. Required; no keys throws DeploySecretsCli.NoKeys.

Behavior

Shells out to the adapter’s CLI tool with the given scope. Returns a newline-separated KEY=VALUE block on success. The adapter CLI must be installed locally.

Examples

examples (illustrative — do not type)

wheels deploy fetch-secrets --adapter=op --from=op://Production/App DATABASE_URL
wheels deploy fetch-secrets --adapter=aws --from=prod/app DB_PASSWORD

Wrap inside .kamal/secrets for batched resolution:

.kamal/secrets (illustrative — do not type)

$(wheels deploy fetch-secrets --adapter=op --from=op://Production/App DATABASE_URL WHEELS_MASTER_KEY)