GH-SECRET-SET(1)

🌸 GH-SECRET-SET(1) — the GitHub CLI manual, bestie edition 🌸

okay so this is gh-secret-set(1) from the GitHub CLI manual, and honestly it's kind of iconic — it's the page that teaches you how to put a secret into GitHub without ever letting it touch the internet unprotected. let's get into it 💅

---

✨ NAME ✨

gh-secret-set — create or update secrets. that's it, that's the whole vibe. you're setting secrets, you're updating secrets, you're doing the most, you're slaying 🎀

---

🦋 SYNOPSIS 🦋

gh secret set <secret-name> [flags]

like, you give it a name and then flags do the rest. <secret-name> is the placeholder, bestie — swap it for your actual secret name 💖

---

💜 DESCRIPTION 💜

so you're setting a value for a secret, right? and there are levels, and the level you pick decides who gets to use that secret. pick your main character level:

• repository (this is the default, no cap) — available to GitHub Actions runs, Agents sessions, or Dependabot in a repository
• environment — available to GitHub Actions runs for a deployment environment in a repository
• organization — available to GitHub Actions runs, Agents sessions, Dependabot, or Codespaces within an organization
• user — available to Codespaces for your user

and here's a cute little extra: organization and user secrets can optionally be restricted so they're only available to specific repositories. very exclusive. very VIP. ✨

also, and this is the part that matters: secret values are locally encrypted before being sent to GitHub. the encryption happens on your machine, not theirs. we love a privacy-forward queen 🫶

---

🌈 OPTIONS 🌈

• -a, --app <string> — set the application for a secret, one of: {actions|agents|codespaces|dependabot}
• -b, --body <string> — the actual value for the secret. heads up: if you don't specify this, it reads from standard input instead 🙈
• -e, --env <environment> — set a deployment environment secret
• -f, --env-file <file> — load secret names and values from a dotenv-formatted file. batch mode, we love her 💅
• --no-repos-selected — no repositories can access the organization secret. literally none. zero. a closed door 🚪
• --no-store — print the encrypted, base64-encoded value instead of storing it on GitHub. great for when you just want to see the goods 👀
• -o, --org <organization> — set organization secret
• -r, --repos <repositories> — list of repositories that can access an organization or user secret
• -u, --user — set a secret for your user
• -v, --visibility <string> (default "private") — set visibility for an organization secret, one of: {all|private|selected}

---

🧚 OPTIONS INHERITED FROM PARENT COMMANDS 🧚

• -R, --repo <[HOST/]OWNER/REPO> — select another repository using the [HOST/]OWNER/REPO format. yes the [HOST/] part is optional, yes that's fancy of it ⭐

---

🔥 EXIT CODES 🔥

okay so this is how you know how it went:

• 0: successful execution — we ate and left no crumbs 👑
• 1: error — it's giving struggle 😭
• 2: command canceled — you (or something) hit stop
• 4: authentication required — github needs to know who you are, bestie

NOTE: specific commands may have additional exit codes. refer to the command's help for more information. iykyk 💀

---

🍓 EXAMPLE 🍓

here's where it gets fun. every single one of these is a mood:

# Paste secret value for the current repository in an interactive prompt
$ gh secret set MYSECRET

# Read secret value from an environment variable
$ gh secret set MYSECRET --body "$ENV_VALUE"

# Set secret for a specific remote repository
$ gh secret set MYSECRET --repo origin/repo --body "$ENV_VALUE"

# Read secret value from a file
$ gh secret set MYSECRET < myfile.txt

# Set secret for a deployment environment in the current repository
$ gh secret set MYSECRET --env myenvironment

# Set organization-level secret visible to both public and private repositories
$ gh secret set MYSECRET --org myOrg --visibility all

# Set organization-level secret visible to specific repositories
$ gh secret set MYSECRET --org myOrg --repos repo1,repo2,repo3

# Set organization-level secret visible to no repositories
$ gh secret set MYSECRET --org myOrg --no-repos-selected

# Set user-level secret for Codespaces
$ gh secret set MYSECRET --user

# Set repository-level secret for Dependabot
$ gh secret set MYSECRET --app dependabot

# Set multiple secrets imported from the ".env" file
$ gh secret set -f .env

# Set multiple secrets from stdin
$ gh secret set -f - < myfile.txt

literally the range. from a single interactive prompt to importing a whole .env file like a boss 🌸

---

💖 SEE ALSO 💖

• gh-secret(1) — the whole secret family, go meet the rest of the squad

---

okay that's the whole page, bestie!! 🦋 this was GitHub CLI v2.102.0, dated Oct 2026, and it's the GH-SECRET-SET(1) page from the GitHub CLI manual. go forth and encrypt responsibly, mwah 💋✨