> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ishlabs.io/llms.txt
> Use this file to discover all available pages before exploring further.

# secret

> Command reference: ish secret.

## `ish secret list`

List secret keys for the active workspace (values never returned)

Usage: `ish secret list [options]`

### Options

<ParamField path="--workspace <id>" type="string">Workspace ID; defaults to active workspace</ParamField>

## `ish secret set`

Create or update a workspace secret

Usage: `ish secret set <key> [value] [options]`

### Arguments

<ParamField path="key">Secret key (uppercase, e.g. GROQ\_API\_KEY) (required)</ParamField>
<ParamField path="value">Secret value. Omit when using --value-file or --value-stdin. (optional)</ParamField>

### Options

<ParamField path="--value-file <path>" type="string">Read the value from a file on disk (use "-" for stdin)</ParamField>
<ParamField path="--value-stdin" type="boolean">Read the value from stdin (alias for --value-file -)</ParamField>
<ParamField path="--description <text>" type="string">Optional description (what this secret is used for)</ParamField>
<ParamField path="--scope <scope>" type="string">Visibility scope: agent | project (default: agent) Default: "agent".</ParamField>
<ParamField path="--workspace <id>" type="string">Workspace ID; defaults to active workspace</ParamField>

## `ish secret delete`

Delete a workspace secret by key

Usage: `ish secret delete <key> [options]`

### Arguments

<ParamField path="key">Secret key to delete (required)</ParamField>

### Options

<ParamField path="--workspace <id>" type="string">Workspace ID; defaults to active workspace</ParamField>
<ParamField path="-y, --yes" type="boolean">Skip confirmation prompt (required in --json or non-TTY contexts)</ParamField>

## Global flags

Every command accepts the global flags.

<ParamField path="-V, --version" type="boolean">output the version number</ParamField>
<ParamField path="-t, --token <token>" type="string">Auth token (or set ISH\_TOKEN env var)</ParamField>
<ParamField path="--token-file <path>" type="string">Read auth token from a file (preferred over --token / ISH\_TOKEN)</ParamField>
<ParamField path="--workspace <id>" type="string">Default workspace ID; per-subcommand --workspace overrides</ParamField>
<ParamField path="--json" type="boolean">Output as JSON (auto-enabled when piped)</ParamField>
<ParamField path="--get <field>" type="string">Extract a single field from the JSON response and print only its value (implies --json internally; supports dotted paths e.g. person.name)</ParamField>
<ParamField path="--human" type="boolean">Force human-readable output even when stdout is piped (overrides JSON-when-piped auto-detection)</ParamField>
<ParamField path="--fields <fields>" type="string">Comma-separated fields to include in JSON output (e.g. alias,name,status)</ParamField>
<ParamField path="--verbose" type="boolean">Include full UUIDs and timestamps in JSON output</ParamField>
<ParamField path="--no-color" type="boolean">Disable colored output (also honored: NO\_COLOR env var)</ParamField>
<ParamField path="-q, --quiet" type="boolean">Suppress progress messages on stderr (no-op for read commands that emit none)</ParamField>