> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kombify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# stackkit secrets

> Manage owner-bound local secret custody

Manage owner-bound local secret custody.

```bash theme={null}
stackkit secrets [flags]
```

Subcommands: [`stackkit secrets materialize`](#stackkit-secrets-materialize), [`stackkit secrets reveal`](#stackkit-secrets-reveal)

## stackkit secrets materialize

Establish custody for secret references in the current StackSpec.

Establish or reuse owner-bound local custody for every secret:// reference in the current canonical StackSpec.

Run this explicit, idempotent step after adding a workload to an existing standalone workspace and before generate/apply. It never prints secret references or material and never replaces invalid or foreign custody.

```bash theme={null}
stackkit secrets materialize [flags]
```

**Examples**

```bash theme={null}
# After adding a workload to stack-spec.yaml, create its secrets, then roll out
stackkit secrets materialize
stackkit generate
stackkit apply
```

## stackkit secrets reveal

Print one selected workload secret from local owner custody.

Print the existing value of one secret slot declared by a selected workload in the current CUE-valid StackSpec. Output contains secret material; use it only in a private terminal or an intentional pipe. No value is written to deploy logs or receipts.

```bash theme={null}
stackkit secrets reveal [flags]
```

| Flag         | Type   | Default | Description                                 |
| ------------ | ------ | ------- | ------------------------------------------- |
| `--slot`     | string | —       | **Required.** Declared workload secret slot |
| `--workload` | string | —       | **Required.** Selected workload ID          |

**Examples**

```bash theme={null}
# Print the Photos database password from local owner custody
stackkit secrets reveal --workload photos --slot database-password
```