# atmos secret set

Set the value of a declared secret in its configured backend (create or update). The value can be supplied inline as `NAME=VALUE`, piped in with `--stdin`, or entered through an interactive masked prompt when the command runs in a terminal with no value provided. With no `NAME` (and no `--stack`/`--component`) in a terminal, Atmos walks you through choosing the stack, component, and secret. This command is also available under the `add` alias.

## Usage

```shell
atmos secret set [NAME[=VALUE]] [flags]
```

Setting a secret is **scope-aware**. Atmos normally requires the component that declares the secret.
For a named secret declared with `scope: global`, you may omit `--component`; Atmos discovers a
declaration-bearing component in the selected stack because the component does not affect the global
backend coordinate. Instance- and stack-scoped secrets still require `--component`. See
[Secret scopes](/cli/commands/secret/usage#secret-scopes).

String values are written verbatim to secret stores. This makes values written by `atmos secret set`
round-trip through `!secret NAME | raw` without JSON quote characters being added. Structured maps and
lists supplied through other store APIs remain JSON encoded. Values written by an older Atmos release
may already contain JSON quotes; set those values again with the current release to normalize them.

## Examples

```shell
# Walk through stack → component → secret → value interactively (terminal only)
atmos secret set

# Set a value inline
atmos secret set SERVICE_API_KEY=abc123 --stack=prod --component=example-service

# Set a value interactively with a masked prompt (terminal only)
atmos secret set SERVICE_API_KEY --stack=prod --component=example-service

# Read a multi-line value (such as a PEM key) from standard input
cat key.pem | atmos secret set APP_PRIVATE_KEY --stdin --stack=prod --component=example-service

# A global declaration does not require a component
atmos secret set SHARED_API_KEY=abc123 --stack=prod

# Overwrite an existing value without confirmation
atmos secret set SERVICE_API_KEY=newvalue --stack=prod --component=example-service --force

# Use the `add` alias
atmos secret add SERVICE_API_KEY=abc123 --stack=prod --component=example-service
```

## Arguments

- **`NAME[=VALUE]`**

  The name of the declared secret to set, optionally with an inline value. When `=VALUE` is omitted, the value is read from `--stdin` or from an interactive masked prompt.

## Flags

- **`--stack` (alias `-s`)**

  The Atmos stack to operate on. Required — prompted interactively on a TTY when omitted.

  **Environment variable:** `ATMOS_STACK`
- **`--component` (alias `-c`)**

  The Atmos component that declares the secret. Required except when a positional secret name resolves to a consistent `scope: global` declaration in the selected stack. Prompted interactively on a TTY when no name is supplied.

  **Environment variable:** `ATMOS_COMPONENT`
- **`--type`**

  The component type (`terraform`, `helmfile`, `packer`, or `ansible`). Used to disambiguate when a component name exists in more than one type.
- **`--identity` (alias `-i`)**

  The identity to use when accessing the secret backend.

  **Environment variable:** `ATMOS_IDENTITY`
- **`--stdin`**

  Read the secret value from standard input. Useful for piping multi-line values such as certificates or private keys.
- **`--force` (alias `-f`)**

  Overwrite an existing value without prompting for confirmation.

## See Also

- [atmos secret](/cli/commands/secret/usage) — Overview of the secret command group
- [`!secret` YAML function](/functions/yaml/secret) — Resolve declared secrets at runtime