ish secret list
List secret keys for the active workspace (values never returned)
Usage: ish secret list [options]
Options
string
Workspace ID; defaults to active workspace
ish secret set
Create or update a workspace secret
Usage: ish secret set <key> [value] [options]
Arguments
Secret key (uppercase, e.g. GROQ_API_KEY) (required)
Secret value. Omit when using —value-file or —value-stdin. (optional)
Options
string
Read the value from a file on disk (use ”-” for stdin)
boolean
Read the value from stdin (alias for —value-file -)
string
Optional description (what this secret is used for)
string
Visibility scope: agent | project (default: agent) Default: “agent”.
string
Workspace ID; defaults to active workspace
ish secret delete
Delete a workspace secret by key
Usage: ish secret delete <key> [options]
Arguments
Secret key to delete (required)
Options
string
Workspace ID; defaults to active workspace
boolean
Skip confirmation prompt (required in —json or non-TTY contexts)
Global flags
Every command accepts the global flags.boolean
output the version number
string
Auth token (or set ISH_TOKEN env var)
string
Read auth token from a file (preferred over —token / ISH_TOKEN)
string
Default workspace ID; per-subcommand —workspace overrides
boolean
Output as JSON (auto-enabled when piped)
string
Extract a single field from the JSON response and print only its value (implies —json internally; supports dotted paths e.g. person.name)
boolean
Force human-readable output even when stdout is piped (overrides JSON-when-piped auto-detection)
string
Comma-separated fields to include in JSON output (e.g. alias,name,status)
boolean
Include full UUIDs and timestamps in JSON output
boolean
Disable colored output (also honored: NO_COLOR env var)
boolean
Suppress progress messages on stderr (no-op for read commands that emit none)