Manage secrets

Repster separates secrets from your pipeline code: .env locally, the encrypted Repster Cloud vault for cloud runs.

Local development

For local runs, Repster reads secrets from a .env file at the root of your project. Use dlt's env-var naming convention:

SOURCES__GITHUB__ACCESS_TOKEN=ghp_...
DESTINATION__BIGQUERY__CREDENTIALS__PROJECT_ID=my-project

Never commit .env; add it to .gitignore.

Pushing secrets to cloud

rp secrets push

Reads all key-value pairs from .env and stores them in the vault, encrypted at rest. At run time they're injected into the worker as environment variables, never written to logs or run records (see How Repster works).

To target a specific profile:

rp secrets push --profile prod

Viewing stored secrets (key names only)

rp secrets list

The vault returns key names only; values are never retrievable after being stored.

Rotating a secret

Push the updated value; Repster overwrites the existing entry:

# update .env, then:
rp secrets push

Removing a secret

rp secrets delete SOURCES__GITHUB__ACCESS_TOKEN

Prompts for confirmation (pass --yes to skip). Secrets can also be deleted in the Repster Cloud UI (repster.online).

CI / non-interactive environments

For CI pipelines, skip the interactive login flow by passing a token directly:

REPSTER_API_TOKEN=rpk_... rp secrets push

Or configure it in pyproject.toml:

[tool.repster]
profile = "ci"

And add the profile to ~/.repster/config.toml on the CI machine.