> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-gateway/5/iagctl/describe-secret/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# iagctl describe secret

Display the value of a secret.

The `iagctl describe secret` command decrypts and displays a secret value in your default terminal editor. The gateway opens the decrypted value in the editor set by the `EDITOR` environment variable, or `vim` if `EDITOR` isn't set. The gateway removes the temporary file after you exit the editor to prevent the value from being written to logs.

This command reveals the actual secret value. Use caution when running it in shared environments.

Before you run this command, the gateway needs to know where the encryption key file is located. You can provide the location with the `--encryption-file` flag or by setting the `GATEWAY_SECRETS_ENCRYPT_KEY_FILE` configuration variable.

For more information on creating and managing secrets, see [Create Gateway secret store](../configure-secret-store).

## Syntax

```bash
iagctl describe secret <secret-name> [flags]
```

## Examples

### Display a secret with the encryption file flag

```bash
iagctl describe secret my-secret \
--encryption-file /Users/gatewayuser/.gateway.d/gateway_secret.key
```

### Display a secret with the encryption file configuration variable

The following example assumes you've already set the `GATEWAY_SECRETS_ENCRYPT_KEY_FILE` configuration variable:

```bash
iagctl describe secret my-secret
```

## Options

```bash
  --encryption-file string   The file to use for decrypting the secret.
  -h, --help                 Help for secret
```

## Options inherited from parent commands

```bash
  --profile string   Specify the client profile to use (case-insensitive, defaults to [client] section)
  --config string   Path to the configuration file
  --raw             Display the result of the command in raw format
  --verbose         Enable verbose output
```