# Secret commands: revoke, rotate, store

URL: /code/cli/secret/verbs · Id: `page:code/cli/secret/verbs`

> The Secret Verbs revoke, rotate, store as CLI commands, with inputs, result, refusals and an example.

Reference for [Secret](/business/nouns/secret), one group of [Secret commands](/code/cli/secret).

### Secret.revoke
Revoke ends a Secret so no call fills it again; the record and its history stay. [Verb page](/business/nouns/secret/revoke?interface=cli).

```text
npx startup-builder do Secret.revoke --json '<input>' [--try | --send | --do]
```

Emits [`Secret.revoked`](/business/events/Secret.revoked).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to revoke. |
| `reason` | `text` | No | Why, such as a leaked value. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The revoked Secret. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
npx startup-builder do Secret.revoke --json '{"secret":"secret_UaNXUkKsJB"}'
```

### Secret.rotate
Rotate replaces a Secret’s value, and calls already running finish on the old one. [Verb page](/business/nouns/secret/rotate?interface=cli).

```text
npx startup-builder do Secret.rotate --json '<input>' [--try | --send | --do]
```

Emits [`Secret.rotated`](/business/events/Secret.rotated).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to rotate. |
| `value` | `string` | No | The new value; omitted when the upstream issues one. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, with its new `rotatedAt`. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
npx startup-builder do Secret.rotate --json '{"secret":"secret_UaNXUkKsJB"}'
```

### Secret.store
Store writes a Secret’s value for one environment; the value is never returned by any Interface. [Verb page](/business/nouns/secret/store?interface=cli).

```text
npx startup-builder do Secret.store --json '<input>' [--try | --send | --do]
```

Emits [`Secret.stored`](/business/events/Secret.stored).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | `string` | Yes | The name Functions declare. |
| `value` | `string` | Yes | The credential; write-only. |
| `environment` | `string` | Yes | Where it holds. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, without its value. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
npx startup-builder do Secret.store --json '{"name":"MAPS_KEY","value":"Example value","environment":"test"}'
```