# atmos secret set

Set the value of a declared secret in its configured backend (create or update). The value can be supplied inline as `NAME=VALUE`, piped in with `--stdin`, or entered through an interactive masked prompt when the command runs in a terminal with no value provided. With no `NAME` (and no `--stack`/`--component`) in a terminal, Atmos walks you through choosing the stack, component, and secret. This command is also available under the `add` alias.

## Usage

```shell
atmos secret set [NAME[=VALUE]] [flags]
```

Setting a secret is **scope-aware**: a value set with `--component` is an _instance override_ and is
only allowed if that component declares the secret (otherwise it is a hard error — declare it under
the component first, or omit `--component` to set the shared stack value). See
[Secret scopes](/cli/commands/secret/usage#secret-scopes).

## Examples

```shell
# Walk through stack → component → secret → value interactively (terminal only)
atmos secret set

# Set a value inline
atmos secret set DATADOG_API_KEY=abc123 --stack=prod --component=api

# Set a value interactively with a masked prompt (terminal only)
atmos secret set DATADOG_API_KEY --stack=prod --component=api

# Read a multi-line value (such as a PEM key) from standard input
cat key.pem | atmos secret set GITHUB_APP_KEY --stdin --stack=prod --component=api

# Overwrite an existing value without confirmation
atmos secret set DATADOG_API_KEY=newvalue --stack=prod --component=api --force

# Use the `add` alias
atmos secret add DATADOG_API_KEY=abc123 --stack=prod --component=api
```

## Arguments

- **`NAME[=VALUE]`**

  The name of the declared secret to set, optionally with an inline value. When `=VALUE` is omitted, the value is read from `--stdin` or from an interactive masked prompt.

## Flags

- **`--stack` (alias `-s`)**

  The Atmos stack to operate on. Required — prompted interactively on a TTY when omitted.

  **Environment variable:** `ATMOS_STACK`
- **`--component` (alias `-c`)**

  The Atmos component that declares the secret. Required for instance-scoped secrets — prompted interactively on a TTY when omitted.

  **Environment variable:** `ATMOS_COMPONENT`
- **`--type`**

  The component type (`terraform`, `helmfile`, `packer`, or `ansible`). Used to disambiguate when a component name exists in more than one type.
- **`--identity` (alias `-i`)**

  The identity to use when accessing the secret backend.

  **Environment variable:** `ATMOS_IDENTITY`
- **`--stdin`**

  Read the secret value from standard input. Useful for piping multi-line values such as certificates or private keys.
- **`--force` (alias `-f`)**

  Overwrite an existing value without prompting for confirmation.

## See Also

- [atmos secret](/cli/commands/secret/usage) — Overview of the secret command group
- [`!secret` YAML function](/functions/yaml/secret) — Resolve declared secrets at runtime