Managing Secrets

DaemonHound's secret store provides named, versioned secrets with automatic file rewriting when values change.

Storing a secret

Shell

dhd secret set openai-key
# Enter secret value: ••••••••
# ✓ Secret stored

Mapping secrets to files

One secret, different env var names per project:

Shell

cd ~/projects/my-api
dhd secret ref openai-key .env.local OPENAI_API_KEY

cd ~/projects/portfolio
dhd secret ref openai-key .env.local OPENAI_KEY

cd ~/projects/cli-tool
dhd secret ref openai-key .env AI_TOKEN

Auto-rewrite on rotation

Shell

dhd secret set openai-key NEW_VALUE
# → Updated .env.local in github.com/you/my-api     (OPENAI_API_KEY)
# → Updated .env.local in github.com/you/portfolio   (OPENAI_KEY)
# → Updated .env in github.com/you/cli-tool          (AI_TOKEN)
# → 3 files marked dirty — run dhd sync to push

Managing secrets

Shell

dhd secret get openai-key        # Retrieve value
dhd secret list                  # List all secrets
dhd secret list openai-key       # Show mappings
dhd secret rename old-key new    # Rename, keep mappings
dhd secret rotate openai-key    # Change value
dhd secret delete openai-key    # Delete + all mappings

Version history

Shell

dhd secret history openai-key
# v3  2026-07-28T14:22:00Z  rotated
# v2  2026-07-15T09:11:00Z  initial

dhd secret diff openai-key       # Compare versions
dhd secret rollback openai-key   # Restore previous

Web UI

Run dhd ui for the browser-based Secrets Manager: version viewer, diff comparison, rotation control, full history.

Storage format

Each secret is an encrypted TOML file:

TOML (encrypted)

name = "openai-key"
created_at = "2026-07-15T09:11:00Z"
updated_at = "2026-07-28T14:22:00Z"

[[versions]]
value = "sk-..."
created_at = "2026-07-28T14:22:00Z"
reason = "rotated"

[[versions]]
value = "sk-..."
created_at = "2026-07-15T09:11:00Z"
reason = "initial"

Daemon Merge & Conflicts