Run your app with Secrets
Create a vault, add development values, and inject them using the OutRay CLI.
1. Create a vault
Select the intended organization, open Secrets → Vaults, and create a vault such as orders-api. Owners and admins manage vaults and environments. A new vault includes Development, Staging, and Production environments; each starts with its own values.
Open Development and add a key your application already reads, such as DATABASE_URL. Give it the appropriate development value. Keys use uppercase letters, numbers, and underscores and cannot start with a number.
2. Authenticate the CLI
npm install -g outray
outray loginUse the browser login for local development. For non-interactive jobs, use a scoped API token through OUTRAY_TOKEN in your runner's secret settings.
3. Select the environment
From the application's directory:
outray secrets use --org my-team --vault orders-api --env development
outray secrets listReplace my-team and orders-api with your organization and vault slugs. The use command stores target identifiers in the nearest outray/config.toml; it does not save secret values there. list shows key names, versions, and update times, not plaintext values.
4. Start the application
outray secrets run -- npm run devThe CLI retrieves the selected values and starts a child process with them in its environment. Secret keys override matching inherited variables. The parent shell is unchanged, and no dotenv file is created. The CLI removes its own OUTRAY_TOKEN and OUTRAY_API_KEY credentials from the child process.
Verify through the application's normal behavior, not by printing a credential. If the app also sends observability data, name that secret something distinct, such as OBSERVABILITY_TOKEN, and pass it explicitly to the SDK's apiKey option.
Next steps and troubleshooting
Use CLI workflows for imports, exports, watch mode, and production confirmation. Keep environments separate; selecting a target does not copy values between them.
If the vault or environment is unavailable, check its slug, the active organization, and the token's resource boundary. If authentication is required, run outray login again or check the machine token's expiry and revocation. A write conflict means values changed after the client read them; refresh and review before retrying.