Secrets

Set and rotate Tako app secrets, access typed values from JavaScript, Go, or Rust, and distinguish app secrets from provider credentials.

App secrets are encrypted per environment and delivered to your app through the Tako SDK. Use secrets for database URLs, API keys, and other private application values. Non-secret process variables belong in [vars] or [vars.<env>] in tako.toml.

Set a secret

From the directory containing tako.toml, select the environment explicitly:

tako secrets set DATABASE_URL --env development
tako secrets set DATABASE_URL --env production
tako generate

The CLI prompts for a masked value. Non-interactive calls read stdin; MCP setters accept stdin as a named argument. Pass the secret through that input rather than putting its value into a command line. Non-interactive set requires --env.

Secrets are stored encrypted in .tako/secrets.json. Keep that file trackable with the project; tako init updates .gitignore accordingly. Encryption keys live outside the project. Copying the encrypted file alone does not grant a new machine access.

Read from application code

Use the SDK matching your backend:

import { tako } from "tako.sh";

const databaseUrl = tako.secrets.DATABASE_URL;
if (!databaseUrl) throw new Error("DATABASE_URL is not configured");

package main

import "tako.sh"

func databaseURL() string {
    return tako.GetSecret("DATABASE_URL")
}

fn database_url() -> Option<String> {
    tako::secret("DATABASE_URL")
}

For JavaScript, tako generate refreshes tako.d.ts with known secret names. Do not edit generated declarations. Read individual values: serialization of the secrets object is redacted, and spreading it does not copy its values. An individually accessed value is an ordinary string; do not log it or return it to a browser.

Go uses tako.GetSecret("DATABASE_URL") or the generated Secrets.DatabaseUrl() accessor after tako generate. Rust uses tako::secret("DATABASE_URL"), which returns Option<String>. See the matching SDK skill for listener and bootstrap setup.

Ordinary app code does not receive app secrets as individual process environment variables. Native processes receive SDK bootstrap on fd 3; containers and tako run use TAKO_BOOTSTRAP_DATA. Use the SDK rather than reading the envelope yourself. Release commands additionally receive decrypted secrets as process environment variables.

Apply changes to deployed apps

Setting a secret changes the local encrypted project file. Deploy sends changed secrets, or sync them to the current deployment:

tako secrets set DATABASE_URL --env production --sync
tako secrets sync --env production

Sync rolls fresh app processes so they receive updated bootstrap values. If any selected-environment secret cannot decrypt, Tako refuses the partial sync. In development, attached tako dev sessions watch secret changes; restart a background session when needed.

Remove a secret from a specific environment with:

tako secrets rm OLD_API_KEY --env production --sync

Expiry and key access

Set an optional expiry with --expires-on YYYY-MM-DD or --expires-on "in 30 days". Deployment rejects expired secrets for its selected environment and warns when expiry is within 30 days.

For an authorized machine or team migration, key import/export commands are documented in the CLI reference. A decryption failure is a key-access problem; see troubleshooting. Do not replace a working environment’s keys as a debugging shortcut.

Provider and storage credentials

These serve different consumers:

tako credentials set ssl.cloudflare --env production
tako credentials set postgres_url --env production

Provider credentials are for deployed environments, are encrypted in .tako/secrets.json, and are not exposed through app secrets. tako secrets sync does not sync them; deployment applies the relevant runtime bindings. Your application’s own database URL remains a separate app secret even if Tako’s runtime state also uses Postgres.

Verify

Use tako secrets list --json and tako credentials list --json to inspect configured metadata. Test the app’s real connection or authenticated operation in the intended environment, without printing credentials. After rotation, confirm that the new app processes can use the value and inspect finite logs for failures.