otty / apps
All apps/SecretSpec

SecretSpec

secretspec

A declarative interface for every secret provider.

Runs as secretspec|macOS, Linux, Windows|secretspec.dev
Open form in Otty otty.toml

Command form

ai-draft · 4 tasks · 15 fields

Check, read and run commands with secrets declared in secretspec.toml. Set, import, init and provider configuration subcommands are left out.

Opens the form; the finished command lands at your prompt, unrun
Run in Otty
otty gui secretspec

secretspec check

Check secrets

Verify that every declared secret resolves, without printing values.

Check secretsExample values, fixed in this page — nothing here reaches a terminal
Basic
Profile
string
TasksEach one presets the form for one job
Check a profile
profile
Explain resolution
profile
ParametersOnly these flags are editable in the form
Profile
string
--profile-P
Provider
Provider URI or name, for example env or dotenv://.env.
string
--provider-p
secretspec.toml path
path
--file-f
Do not prompt
boolean
--no-prompt-n
JSON report
boolean
--json
Explain resolution
boolean
--explain

secretspec get

Get one secret

Print the value of a single secret to the terminal.

Get one secretExample values, fixed in this page — nothing here reaches a terminal
Basic
Secret name*
string
Profile
string
TasksEach one presets the form for one job
Get a secret
nameprofile
ParametersOnly these flags are editable in the form
Secret name
string · positional 0
Profile
string
--profile-P
Provider
string
--provider-p
secretspec.toml path
path
--file-f

secretspec run

Run with secrets

Run a command with the declared secrets injected as environment variables.

Run with secretsExample values, fixed in this page — nothing here reaches a terminal
Basic
Profile
string
Access reason
string
Command*
string
TasksEach one presets the form for one job
Run a command
profilereasoncommand
ParametersOnly these flags are editable in the form
Profile
string
--profile-P
Provider
string
--provider-p
Access reason
Recorded by providers that support audit logging.
string
--reason
secretspec.toml path
path
--file-f
Command
Command and arguments to run, placed after --.
string · positional 0 · repeatable
SourcesEvery flag above is checked against these
cli
secretspec check [OPTIONS] -p, --provider <PROVIDER> - Provider backend to use -P, --profile <PROFILE> - Profile to use -n, --no-prompt - Don't prompt for missing secrets (exit with error if any are missing) --json - Print a value-free resolution report as JSON instead of prompting --explain - Print a value-free, human-readable resolution trace instead of pr…
manual2026-10-27

secretspec.dev

cli
secretspec get [OPTIONS] <NAME> -p, --provider <PROVIDER> - Provider backend to use -P, --profile <PROFILE> - Profile to use $ secretspec get DATABASE_URL --profile production -f, --file <FILE>Path to secretspec.toml (default: auto-detect). Env: SECRETSPEC_FILE
manual2026-10-27

secretspec.dev

cli
secretspec run [OPTIONS] -- <COMMAND> $ secretspec run --reason "Deploying web frontend" -- ./deploy.sh --reason <REASON>Reason for accessing secrets, recorded by providers that support audit logging (e.g. Proton Pass agent sessions). -p, --provider <PROVIDER> - Provider backend to use -P, --profile <PROFILE> - Profile to use -f, --file <FILE>Path to secrets…
manual2026-10-27

secretspec.dev

Before it fills your prompt, Otty checks the installed secretspec against its version. A form that does not match your version is not offered.