# atmos secret get

Retrieve the value of a declared secret from its configured backend. `get` is a value-producing command, so it always fetches the real value from the backend. The displayed value is redacted unless you pass the global `--mask=false` flag. For structured secrets, use `--path` to extract a single nested field with a YQ expression.

## Usage

```shell
atmos secret get NAME [flags]
```

## Examples

```shell
# Retrieve a secret (displayed masked by default)
atmos secret get DATADOG_API_KEY --stack=prod --component=api

# Reveal the real value
atmos secret get DATADOG_API_KEY --stack=prod --component=api --mask=false

# Output as JSON
atmos secret get DATADOG_API_KEY --stack=prod --component=api --format=json

# Output as a shell-sourceable env assignment
atmos secret get DATADOG_API_KEY --stack=prod --component=api --format=env

# Extract a nested field from a structured secret with a YQ path
atmos secret get DB_CREDENTIALS --stack=prod --component=api --path='.credentials.password'

# Copy the raw value to the clipboard with no trailing newline
atmos secret get DATADOG_API_KEY --stack=prod --component=api --mask=false --raw | pbcopy
```

## Arguments

- **`NAME`**

  The name of the declared secret to retrieve.

## Flags

- **`--stack` (alias `-s`)**

  The Atmos stack to operate on. **Required.**

  **Environment variable:** `ATMOS_STACK`
- **`--component` (alias `-c`)**

  The Atmos component that declares the secret. **Required.**

  **Environment variable:** `ATMOS_COMPONENT`
- **`--type`**

  The component type (`terraform`, `helmfile`, `packer`, or `ansible`). Used to disambiguate when a component name exists in more than one type.
- **`--identity` (alias `-i`)**

  The identity to use when accessing the secret backend.

  **Environment variable:** `ATMOS_IDENTITY`
- **`--format`**

  The output format: `text`, `json`, or `env`. Defaults to `text`.
- **`--path`**

  Extract a nested value from a structured secret using a YQ path expression (for example, `.host` or `.credentials.password`).
- **`--raw` (alias `-r`)**

  Print the raw value with **no trailing newline** (text only). Ideal for piping into another command or the clipboard (for example, `--raw | pbcopy`) without capturing a stray newline. Combine with `--path` to extract a scalar from a structured secret. Cannot be combined with `--format=json` or `--format=env`.

:::note Masking
`get` always retrieves the real value because it is a value-producing command. The global `--mask` flag only controls whether the displayed value is redacted — pass `--mask=false` to reveal it.
:::

## See Also

- [atmos secret](/cli/commands/secret/usage) — Overview of the secret command group
- [`!secret` YAML function](/functions/yaml/secret) — Resolve declared secrets at runtime