rekor secrets

Manage organization vault secrets

Subcommands

rekor secrets create

Store a vault secret (a string value, or a file via --file as base64)

• --name <name> — Secret name
• --value <value> — Secret value (plain string)
• --file <path> — Read the value from a file and base64-encode it (certificates, keystores, SA JSON)
• --content-type <mime> — MIME type of the value (e.g. application/x-pkcs12)
• --expires-at <date> — Expiry as ISO-8601 (e.g. 2027-01-01T00:00:00Z) — surfaced by `list --expiring`
• --tags <tags> — Comma-separated tags

rekor secrets list

List vault secrets (values masked)

• --expiring — Only secrets expiring within --days (default 30)
• --days <n> — Window for --expiring, in days

rekor secrets get <id>

Get vault secret metadata (value masked)

rekor secrets rotate <id>

Rotate a secret by installing a new caller-supplied value (from --value or --file)

• --value <value> — New secret value (plain string)
• --file <path> — Read the new value from a file and base64-encode it

rekor secrets delete <id>

Delete a vault secret

• -y, --yes — Skip confirmation prompt