{
  "schema_version": 2,
  "id": "integrate/redis-data-integration/reference/cli/redis-di-set-secret",
  "title": "redis-di set-secret",
  "url": "https://redis.io/docs/latest/integrate/redis-data-integration/reference/cli/redis-di-set-secret/",
  "summary": "Creates or updates a secret of a pipeline",
  "aliases": [
    "/integrate/redis-data-integration/ingest/reference/cli/redis-di-set-secret/"
  ],
  "tags": [
    "redis-di"
  ],
  "last_updated": "2026-09-18T16:41:35+01:00",
  "page_type": "content",
  "content_hash": "c0367a8452209c9681c43c7f360fec87b3ebaf68528c2b0fcd7e6c38e560ce74",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Creates or updates a secret of a pipeline. Secrets hold the credentials and certificates that the\npipeline uses to connect to its source and target databases (see\n[Set secrets](https://redis.io/docs/latest/integrate/redis-data-integration/data-pipelines/deploy#set-secrets)\nfor the secret keys). Every secret belongs to one database, which you name with `--db`: a source, or\n`target`. RDI combines the key and the database into the environment variable that `config.yaml`\nreferences, so `PASSWORD` with `--db mysql` becomes `${MYSQL_DB_PASSWORD}`. For a source that\nexisted before RDI supported multiple sources, the variable is still named `SOURCE_DB_PASSWORD`; see\n[Existing names are kept after an upgrade](https://redis.io/docs/latest/integrate/redis-data-integration/data-pipelines/multiple-sources#existing-names-are-kept-after-an-upgrade).\n\nThe secret value comes from the `[value]` argument, the `--file` option, or the `--literal` option.\nIf you provide none of these on an interactive terminal, the command prompts for the value without\nechoing it."
    },
    {
      "id": "usage",
      "title": "Usage",
      "role": "syntax",
      "text": "[code example]"
    },
    {
      "id": "options",
      "title": "Options",
      "role": "parameters",
      "text": "| Option             | Description                                                                       |\n| :----------------- | :-------------------------------------------------------------------------------- |\n| `-p`, `--pipeline` | Pipeline to target (default `default`).                                           |\n| `--db`             | Database the secret belongs to: a source name, or `target`.                       |\n| `--file`           | Read the secret value from the file at this path.                                 |\n| `--literal`        | Use this literal string as the secret value.                                      |\n| `--wait`           | Wait for the pipeline to reach the expected state (default `true`).               |\n| `--timeout`        | Maximum time to wait for the pipeline to reach the expected state (default `2m`). |\n\nThis command also accepts the\n[global options](https://redis.io/docs/latest/integrate/redis-data-integration/reference/cli/redis-di#global-options)."
    },
    {
      "id": "example",
      "title": "Example",
      "role": "example",
      "text": "[code example]"
    }
  ],
  "examples": [
    {
      "id": "usage-ex0",
      "language": "plaintext",
      "code": "redis-di set-secret <key> [value] [flags]",
      "section_id": "usage"
    },
    {
      "id": "example-ex0",
      "language": "bash",
      "code": "# Value from an argument\nredis-di set-secret USERNAME --db mysql myuser\n\n# Value from a file (for example, a certificate)\nredis-di set-secret CACERT --db mysql --file /path/to/myca.crt\n\n# Value read from an interactive prompt\nredis-di set-secret PASSWORD --db mysql\n\n# Target database credentials\nredis-di set-secret PASSWORD --db target mypassword",
      "section_id": "example"
    }
  ]
}