CorvusControl every secret.

#!/usr/bin/env bash
set -euo pipefail

# Create a secret from a file
corvus apply secret DB_PASSWORD \
  --from-file=./db-pass.txt \
  --note "initial prod DB password"

# Create from an env var
export SENTRY_DSN="https://…@sentry.io/42"
corvus apply secret SENTRY_DSN --from-env=SENTRY_DSN

# Create a KV secret with custom fields
corvus apply secret stripe/prod \
  --from-env=STRIPE_SECRET_KEY \
  --field 'note=live key, rotate quarterly' \
  --field 'kind=api-key'

# List all secrets in the project (metadata only, no values)
corvus get secrets

# Filter by key prefix
corvus get secrets -l stripe

# Show one secret's metadata
corvus get secret DB_PASSWORD

#!/usr/bin/env bash
set -euo pipefail

export DATABASE_URL
DATABASE_URL="$(corvus get secret DATABASE_URL -o value)"
psql "$DATABASE_URL" -c 'SELECT 1'

# Hierarchical keys work
corvus get secret prod/db/password -o value

# List metadata only (no values), filter key/note/custom fields
corvus get secrets -l platform-team

#!/usr/bin/env bash
set -euo pipefail

openssl rand -base64 32 \
  | corvus apply secret APP_SESSION_KEY --from-file=-

NEW="$(openssl rand -hex 24)"
export NEW
corvus apply secret API_KEY --from-env=NEW --note "rotated in CI"
unset NEW

export API_KEY
API_KEY="$(corvus get secret API_KEY -o value)"
./deploy.sh

# Caller
corvus reveal secret API_KEY --reason "debugging prod auth #1234"

# Project admin or team owner
corvus get requests
corvus approve <request-id> --minutes 15
# corvus deny <request-id>

corvus get secret API_KEY -o value

# Machine tokens (ss_…) skip human ACL and reveal approval

#!/usr/bin/env bash
set -euo pipefail

: "${SS_URL:?}" "${SS_TOKEN:?}" "${SS_PROJECT:?}"

if [[ -n "${BUILD_API_KEY:-}" ]]; then
  corvus apply secret BUILD_API_KEY \
    --from-env=BUILD_API_KEY \
    --note "ci ${CI_COMMIT_SHA:-local}"
fi

export DATABASE_URL
DATABASE_URL="$(corvus get secret DATABASE_URL -o value)"
./run-migrations.sh