Configuration

The SecretStash CLI can be configured differently depending on whether you are using it within a Laravel application or as a standalone tool in any PHP project.

Laravel Configuration

Once you've installed the SecretStash CLI and optionally published the configuration file, you can customize its behavior in config/secret-stash.php.

API Token

Your personal API token for authenticating with the SecretStash API. You can generate this token using the secret-stash:token command or through the SecretStash web interface.

'api_token' => env('SECRET_STASH_API_TOKEN'),

Application ID

The unique application ID supplied to you by the SecretStash service. This ID identifies which application's variables the CLI should interact with.

'application_id' => env('SECRET_STASH_APPLICATION_ID'),

Ignored Variables

A list of environment variables that should be ignored when pushing to or pulling from the SecretStash API. These keys are case-sensitive.

'ignored_variables' => [],

API URL

The base URL for your SecretStash API instance. This should include the protocol (http/https) and domain, but not the /api path.

'api_url' => env('SECRET_STASH_API_URL', 'https://secretstash.cloud'),

Publish the Config File

To publish the configuration file, run:

php artisan vendor:publish --tag=secret-stash-config

Standalone Configuration

When using the CLI outside of Laravel (via vendor/bin/secret-stash), there is no config file to publish. Instead, the CLI resolves configuration using the following priority order:

1. System environment variables (highest priority)
2. .env file in the current working directory
3. Default values

This means you can configure the CLI entirely through your project's .env file or by exporting environment variables in your shell.

Default Values

When running in standalone mode, the following defaults apply:

Key Directory Override

By default, the SecretStash CLI stores device keys and metadata in the ~/.secret-stash/ directory. You can override this path by setting the SECRET_STASH_KEY_DIR environment variable:

export SECRET_STASH_KEY_DIR=/path/to/custom/key/directory

When SECRET_STASH_KEY_DIR is set, all SecretStash CLI commands (secret-stash:variables, secret-stash:envelope, secret-stash:keys, etc.) will read device keys and metadata from the specified directory instead of ~/.secret-stash/.

This is primarily used to support temporary device keys in CI/CD pipelines. When you run secret-stash:keys init --temporary, the CLI generates keys into an isolated /tmp directory and prints the SECRET_STASH_KEY_DIR export line. Setting this variable in subsequent pipeline steps allows those commands to locate the temporary keys.

Environment Variables

Both Laravel and standalone modes support the following environment variables. In Laravel, these are typically set in your .env file and read via config/secret-stash.php. In standalone mode, they are read directly from system environment variables or the .env file.