Skip to main content

atmos secret get

Retrieve the value of a declared secret from its configured backend. get is a value-producing command, so it always fetches the real value from the backend. The displayed value is redacted unless you pass the global --mask=false flag. For structured secrets, use --path to extract a single nested field with a YQ expression.

atmos secret get --help

Usage​

atmos secret get NAME [flags]

Examples​

# Retrieve a secret (displayed masked by default)
atmos secret get DATADOG_API_KEY --stack=prod --component=api

# Reveal the real value
atmos secret get DATADOG_API_KEY --stack=prod --component=api --mask=false

# Output as JSON
atmos secret get DATADOG_API_KEY --stack=prod --component=api --format=json

# Output as a shell-sourceable env assignment
atmos secret get DATADOG_API_KEY --stack=prod --component=api --format=env

# Extract a nested field from a structured secret with a YQ path
atmos secret get DB_CREDENTIALS --stack=prod --component=api --path='.credentials.password'

# Copy the raw value to the clipboard with no trailing newline
atmos secret get DATADOG_API_KEY --stack=prod --component=api --mask=false --raw | pbcopy

Arguments​

NAME

The name of the declared secret to retrieve.

Flags​

--stack (alias -s)

The Atmos stack to operate on. Required.

Environment variable: ATMOS_STACK

--component (alias -c)

The Atmos component that declares the secret. Required.

Environment variable: ATMOS_COMPONENT

--type

The component type (terraform, helmfile, packer, or ansible). Used to disambiguate when a component name exists in more than one type.

--identity (alias -i)

The identity to use when accessing the secret backend.

Environment variable: ATMOS_IDENTITY

--format

The output format: text, json, or env. Defaults to text.

--path

Extract a nested value from a structured secret using a YQ path expression (for example, .host or .credentials.password).

--raw (alias -r)

Print the raw value with no trailing newline (text only). Ideal for piping into another command or the clipboard (for example, --raw | pbcopy) without capturing a stray newline. Combine with --path to extract a scalar from a structured secret. Cannot be combined with --format=json or --format=env.

Masking

get always retrieves the real value because it is a value-producing command. The global --mask flag only controls whether the displayed value is redacted — pass --mask=false to reveal it.

See Also​