Skip to content
GRIMOIRY

Remove a shared secret

$ grim secrets:delete GEOIP_API_KEY

A service was cancelled, a key was stored under a misspelled name, or a project-specific value ended up in the shared list by mistake and now overwrites everyone's .env on install. grim secrets:delete takes one key out of the registry.

It stops the secret from spreading. It does not take it back from anywhere it has already been written.

Usage

$ grim secrets:list                        # find the exact key first
$ grim secrets:delete GEOIP_API_KEY        # asks, then deletes

It runs from anywhere and needs a login from grim auth:login, on an account the registry lets manage secrets.

Arguments and options

Delete a shared secret from the GRIM registry

Usage

grim secrets:delete <key>

Arguments

Argument Description
key Secret key to delete (required)

What it actually does

  1. Asks. Delete secret GEOIP_API_KEY? [y/N]. Anything but y ends the command without a word and without contacting the registry.
  2. Deletes the key in the registry.
  3. Prints ✓ Secret GEOIP_API_KEY deleted.

The registry never shows a value again once it is stored, and deleting it removes the only central copy. If the credential is still in use somewhere, make sure you can get it from the service that issued it before you answer y.

Pitfalls

Projects and servers keep their copy

The line stays in every .env that grim install already wrote, and in every deployed environment. When the point is that the credential must stop working, revoke it at the service that issued it; deleting it here does not do that.

In a script it deletes nothing

There is no --force. With --no-interaction the question answers itself with no, and the command exits successfully having done nothing. Deleting a shared secret is meant to be done by a person at a terminal.

After it finishes

grim secrets:list no longer shows the key, and the next grim install in any project no longer writes it. To replace a secret instead of removing it, skip the delete: grim secrets:set overwrites an existing key.

grim secrets:list

See the shared secrets

Show which shared credentials the registry holds, by key and description, without ever showing a value.

grim secrets:set

Store a shared secret

Save a credential in the registry once, so grim install writes it into the .env of every project set up after that.

grim install

Assemble the whole project

Turn grim.json into a working project by fetching core, every module and theme, writing grim.lock, building the image and starting the stack.

grim auth:login

Log grim in to GitHub

Give grim a GitHub token, from your gh login or a personal access token, and hand the same token to Composer and Docker.

Recipes that use it

Change config on a live app

Set one value in a server's .env, confirm the app reads it, change many values through a pull and a push, rotate a secret the whole team shares, and apply an edit on a stack you run yourself.