Command: ennote secret

The secret command group provides commands for creating, retrieving, and injecting secrets from the Ennote platform. You can either print payloads to standard output or inject them directly into the environment variables of a child process.

Overview

View the available commands within the secret group:

bash

ennote secret

Available Commands:
  create      Create a new secret in your workspace
  get         Retrieve a secret and print it, or inject it into a child process

Creating Secrets (ennote secret create)

Create new secrets directly from the terminal. You can pass values via inline flags or pipe data through standard input (stdin) to avoid leaving secrets in your shell history.

bash

ennote secret create <secret-name> [flags]

Examples

bash

# Create a standard login/password secret
ennote secret create "prod-db-credentials" --type LOGIN_PASSWORD --login "admin" --password "supersecret"

# Pipe a .env file directly into a KEYS_VALUES secret
cat .env | ennote secret create "stripe-keys" --type KEYS_VALUES

# Create a 2FA token
ennote secret create "github-2fa" --type TWO_FACTOR --value "JBSWY3DPEHPK3PXP"

# Create a secure note or pipe an SSH key
ennote secret create "arch-notes" --type SECURITY_NOTES --value "Critical infrastructure details"
cat id_rsa | ennote secret create "bastion ssh" --type SECURITY_NOTES

Creation Flags

--type:Type of secret (LOGIN_PASSWORD, KEYS_VALUES, SECURITY_NOTES, TWO_FACTOR).
--login:Login username or email.
--password:Password payload for the secret.
--value:Payload for SECURITY_NOTES or TWO_FACTOR.
--labels:Comma-separated list of labels.
--notes:Optional metadata description.
--url:Associated URL or IP address for the secret.
--organization-id:Target Organization ID.
--workspace-id:Target Workspace ID.

Fetching & Injecting (ennote secret get)

bash

ennote secret get <secret-query> [-- <command>] [flags]

Secret Query Formats

<name>:Fetches the latest version of the secret.
<name>@<version>:Fetches a specific historical version.
<name>:<key>:Fetches the latest version, targets specific key (outputs raw unescaped string).
<name>@<version>:<key>:Fetches a specific version, targets specific key.

Override Flags

You can pass specific flags to override your current active configuration for a single command execution:

--organization-id:Target Organization ID (Overrides local config and environment variables).
--workspace-id:Target Workspace ID (Overrides local config and environment variables).

Outputting Data (Stdout)

bash

# Print the entire payload to console
ennote secret get "stripe"

# Print a specific version and target a specific key
ennote secret get "database@5:password"

# Extract a specific key for bash scripts
export DB_PASS=$(ennote secret get "database:password")

Process Injection (The Core Use-Case)

Instead of piping variables or writing .env files, Ennote securely injects secrets directly into the memory space of a child process.

bash

# Inject all keys from the 'stripe' secret into a Node server
ennote secret get "stripe" -- npm run dev

# Inject keys into the AWS CLI
ennote secret get "aws" -- aws s3 ls

# Inject keys using explicit organization and workspace overrides
ennote secret get "aws" --workspace-id my-wrk-id --organization-id my-org-id -- aws s3 ls

Security Note:

The CLI performs strict $PATH resolution (exec.LookPath) before executing the child command to prevent PATH-hijacking attacks. Secrets are injected into the standard OS execution environment (cmd.Env) and are isolated to that specific process tree.

JSON Type Handling & Serialization

When injecting secrets into child processes, Ennote automatically serializes complex nested JSON objects (e.g., Arrays or nested maps) back into standard JSON strings.

Primitive values (strings, booleans, floats) are injected natively as strings to ensure compatibility with standard application parsers.

Need Help?

If you encounter any issues or have questions, don’t hesitate to contact support. Our team is here to assist you with any challenges you might face.