Secrets are values stored in a mounted engine. This page covers the common operations that work across KV, database, PKI, and transit.

​
Reading and writing (KV v2)

tt secrets write secret/prod/api-key value=sk_live_...
tt secrets read  secret/prod/api-key
tt secrets read  secret/prod/api-key -format=json | jq -r .data.value

tt secrets list secret/prod
tt secrets delete secret/prod/api-key           # soft delete
tt secrets metadata delete secret/prod/api-key  # hard delete + all versions
Versions: 
tt secrets read secret/prod/api-key --version=3
tt secrets undelete secret/prod/api-key --versions=3

​
Dynamic secrets (database)

# One-off short-lived creds
tt secrets read database/creds/prod-postgres
# → {
#     lease_id: "database/creds/prod-postgres/xxx",
#     lease_duration: 3600,
#     data: { username: "v-tt-abc123", password: "..." }
#   }

# Renew the lease
tt lease renew database/creds/prod-postgres/xxx --increment=3600

# Revoke ahead of expiry
tt lease revoke database/creds/prod-postgres/xxx

​
Wrapping (single-use hand-off)

# Producer: wrap a KV read into a one-time-use token
WRAP=$(tt secrets read -wrap-ttl=60s secret/prod/api-key -format=json | jq -r .wrap_info.token)
echo "$WRAP"

# Consumer: unwrap once
tt secrets unwrap "$WRAP"
If anyone else uses the token first, the unwrap fails and you know the hand-off was compromised.

Engines

Where each secret kind lives.

Sharing

Wrapped hand-offs and cross-workspace grants.