Variables and secrets

Weik.io 2026.2

Set the configuration values routes read as Camel properties, per environment, per project or for one integration.

On this page

Commands on this page
weikio get variables
weikio describe variable
weikio variable set
weikio delete variable
weikio get secrets
weikio secret set
weikio secret reveal
weikio delete secret
Exit codes
See also

Variables and secrets are configuration values that routes read as Camel properties, such as {{erp-url}}. A value set without --env is the default, and a value set with --env overrides it in that environment. A project’s values reach every integration of the project, and --integration sets a value that only one integration receives.

Setting a value restarts nothing. The deployments that use it get the new value at their next start. The command lists them with the command line that restarts them, and --restart restarts them for you. Secrets are stored encrypted, never listed with their values, and revealed only where the environment allows it.

Commands on this page#

Command	What it does
`weikio get variables`	List the variables of a project and its integrations.
`weikio describe variable`	Show a variable’s value and description.
`weikio variable set`	Set a variable’s default, or with `--env` one environment’s override.
`weikio delete variable`	Delete a variable’s default, or with `--env` one environment’s override.
`weikio get secrets`	List the secrets of a project and its integrations, without values.
`weikio secret set`	Set a secret’s default, or with `--env` one environment’s override.
`weikio secret reveal`	Print a secret’s value where the environment allows reveals.
`weikio delete secret`	Delete a secret’s default, or with `--env` one environment’s override.

The flags every command accepts, such as --env, --project, -o and --context, are on the CLI reference page and are left out of the tables below.

`weikio get variables`#

List the variables of a project and its integrations. --resolved with --integration shows the value one deployment receives and where it comes from, such as an environment’s override, a deployment override or the integration’s own application.properties.

Terminal

weikio get variables [--project P] [--env E] [--integration N] [--resolved]

Argument or flag	What it does
`<project>`	The project, by default the current one.
`--resolved`	Show what one deployment receives, which needs `--integration`.
`--integration <integration>`	The integration whose own variables to list, or whose deployment `--resolved` shows.

Who can run it: a grant on the project whose role has read.

API: GET /api/v1/projects/{project}/variables, GET /api/v1/environments/{environment}/projects/{project}/variables, GET /api/v1/projects/{project}/integration-variables, GET /api/v1/projects/{project}/integrations/{integration}/variables, GET /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/variables, GET /api/v1/environments/{environment}/projects/{project}/deployments/{name}/configuration.

Terminal

$ weikio get variables --env production --resolved --integration erp-invoice-export

You see

NAME          VALUE                          SOURCE
erp-url       https://erp.example.internal   variable:production
page-size     10                             deployment-override
erp-api-key   ********                       secret:production

Terminal

$ weikio get variables --env devtest --resolved --integration billing

You see

NAME       VALUE                 SOURCE
greeting   Hello from the file   application.properties

`weikio describe variable`#

Show a variable’s value and description.

Terminal

weikio describe variable <p>/<name> [--integration N] [--env E]

Argument or flag	What it does
`<variable>`	The variable, as project/name.
`--integration <integration>`	The integration whose own variable to show.

Who can run it: a grant on the project whose role has read.

API: GET /api/v1/projects/{project}/variables/{name}, GET /api/v1/environments/{environment}/projects/{project}/variables/{name}, GET /api/v1/projects/{project}/integrations/{integration}/variables/{name}, GET /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/variables/{name}.

`weikio variable set`#

Set a variable’s default, or with --env one environment’s override. The command lists the deployments the new value reaches. --restart restarts them, and --dry-run shows the list without writing anything.

Terminal

weikio variable set <p>/<name> <value> [--integration N] [--env E] [--description S] [--restart] [--dry-run] [-y]

Argument or flag	What it does
`<variable>`	The variable, as project/name.
`<value>`	The value.
`--integration <integration>`	The integration whose own variable to set (only its deployments receive it).
`--description <description>`	Description of the variable.
`--restart`	Restart the deployments that use the value, instead of waiting for their next start.
`--dry-run`	Print what would happen and change nothing.
`-y, --yes`	Don’t ask for confirmation.
`--reason <reason>`	Reason for the change, stored with the audit record.

Who can run it: a grant on the project whose role has author. A default, set without --env, needs a grant that covers every environment, and --restart also needs operate.

API: GET /api/v1/projects/{project}/integration-variables, GET /api/v1/projects/{project}/integration-secrets, GET /api/v1/projects/{project}/variables/{name}, GET /api/v1/environments/{environment}/projects/{project}/variables/{name}, PATCH /api/v1/environments/{environment}/projects/{project}/deployments/{name}.

Terminal

$ weikio apply -f ./finance/variables/ -f ./finance/production/variables/ --env production

You see

Target: https://hub.example, project finance (from finance/project.yaml), environment production (--env)
variable finance/erp-url unchanged
variable production/finance/erp-url updated
variable production/finance/page-size created

Terminal

$ weikio variable set finance/page-size 200

You see

Target: https://hub.example, project finance (argument), default environment (no --env)
variable finance/page-size updated (revision 4195)
2 deployments take the new value at their next start:
  devtest      finance/erp-invoice-export   (started)
  production   finance/erp-invoice-export   (started)

To restart them now, run:
  weikio variable set finance/page-size 200 --restart

Terminal

$ weikio variable set finance/page-size 200 --restart

You see

Target: https://hub.example, project finance (argument), default environment (no --env)
Deployments that will restart:
  devtest      finance/erp-invoice-export
  production   finance/erp-invoice-export
'production' is a production environment.
Continue? [y/N] y
variable finance/page-size updated (revision 4196)
deployment devtest/finance/erp-invoice-export restarted
deployment production/finance/erp-invoice-export restarted

Terminal

$ weikio variable set finance/page-size 200 --restart --dry-run --env devtest

You see

Target: https://hub.example, project finance (argument), environment devtest (--env)
Deployments that will restart:
  devtest   finance/erp-invoice-export
variable finance/page-size would be set for devtest
1 deployment takes the new value at its next start:
  devtest   finance/erp-invoice-export   (started)

Terminal

$ weikio variable set shop/greeting 'Hello from orders' --integration orders

You see

Target: https://hub.example, project shop (argument), integration orders (--integration), default environment (no --env)
variable shop/greeting created (integration orders, revision 5120)
1 deployment takes the new value at its next start:
  devtest   shop/orders   (started)

To restart it now, run:
  weikio variable set shop/greeting 'Hello from orders' --integration orders --restart

`weikio delete variable`#

Delete a variable’s default, or with --env one environment’s override. With --env, only that environment’s override goes and the default applies there again.

Terminal

weikio delete variable <p>/<name> [--integration N] [--env E] [--dry-run] [-y]

Argument or flag	What it does
`<variable>`	The variable, as project/name.
`--integration <integration>`	The integration whose own variable to delete.
`--dry-run`	Print what would happen and change nothing.
`-y, --yes`	Don’t ask for confirmation.
`--reason <reason>`	Reason for the change, stored with the audit record.

Who can run it: a grant on the project whose role has author.

API: DELETE /api/v1/projects/{project}/variables/{name}, DELETE /api/v1/environments/{environment}/projects/{project}/variables/{name}, DELETE /api/v1/projects/{project}/integrations/{integration}/variables/{name}, DELETE /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/variables/{name}.

`weikio get secrets`#

List the secrets of a project and its integrations, without values.

Terminal

weikio get secrets [--project P] [--env E] [--integration N]

Argument or flag	What it does
`<project>`	The project, by default the current one.
`--integration <integration>`	The integration whose own secrets to list.

Who can run it: a grant on the project whose role has read.

API: GET /api/v1/projects/{project}/secrets, GET /api/v1/environments/{environment}/projects/{project}/secrets, GET /api/v1/projects/{project}/integration-secrets, GET /api/v1/projects/{project}/integrations/{integration}/secrets, GET /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/secrets.

`weikio secret set`#

Set a secret’s default, or with --env one environment’s override. The value comes from a hidden prompt, from standard input or from --from-file, never from the command line, so it doesn’t end up in the shell history. --as-file stores a file of up to 128 KiB, such as a key, and gives routes its path.

Terminal

weikio secret set <p>/<name> [--integration N] [--env E] [--from-file PATH] [--as-file] [--description S] [--restart] [--dry-run] [-y]

Argument or flag	What it does
`<secret>`	The secret, as project/name.
`--integration <integration>`	The integration whose own secret to set (only its deployments receive it).
`--from-file <from-file>`	File to read the value from, instead of standard input.
`--as-file`	Store the file (up to 128 KiB) and give routes its path.
`--description <description>`	Description of the secret.
`--restart`	Restart the deployments that use the value, instead of waiting for their next start.
`--dry-run`	Print what would happen and change nothing.
`-y, --yes`	Don’t ask for confirmation.
`--reason <reason>`	Reason for the change, stored with the audit record.

Who can run it: a grant whose role has operate in the environment. A default, set without --env, needs a grant that covers every environment.

API: GET /api/v1/projects/{project}/integration-variables, GET /api/v1/projects/{project}/integration-secrets, GET /api/v1/projects/{project}/secrets/{name}, GET /api/v1/environments/{environment}/projects/{project}/secrets/{name}, PATCH /api/v1/environments/{environment}/projects/{project}/deployments/{name}.

Terminal

$ weikio secret set finance/erp-api-key --env devtest

You see

Target: https://hub.example, project finance (argument), environment devtest (--env)
Value:
secret finance/erp-api-key set for devtest (revision 4192)
1 deployment takes the new value at its next start:
  devtest   finance/erp-invoice-export   (started)

To restart it now, run:
  weikio secret set finance/erp-api-key --env devtest --restart

`weikio secret reveal`#

Print a secret’s value where the environment allows reveals. Reveals are allowed only in environments whose protection allows them, and a platform administrator can’t get around that either. Each reveal is written to the audit log and reveals are rate limited.

Terminal

weikio secret reveal <p>/<name> [--integration N] [--env E]

Argument or flag	What it does
`<secret>`	The secret, as project/name.
`--integration <integration>`	The integration whose own secret to reveal.
`--reason <reason>`	Reason for the change, stored with the audit record.

Who can run it: a grant whose role has reveal in the environment, and the environment has to allow reveals.

API: GET /api/v1/environments/{environment}/projects/{project}/secrets/{name}/reveal, GET /api/v1/projects/{project}/secrets/{name}/reveal, GET /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/secrets/{name}/reveal, GET /api/v1/projects/{project}/integrations/{integration}/secrets/{name}/reveal.

Terminal

$ weikio secret reveal finance/erp-api-key --env production

You see

error: Secret reveals aren't allowed in production.
       Ask a platform admin to run:
         weikio env set production --allow-secret-reveal=true

Terminal

$ echo $?

You see

`weikio delete secret`#

Delete a secret’s default, or with --env one environment’s override.

Terminal

weikio delete secret <p>/<name> [--integration N] [--env E] [--dry-run] [-y]

Argument or flag	What it does
`<secret>`	The secret, as project/name.
`--integration <integration>`	The integration whose own secret to delete.
`--dry-run`	Print what would happen and change nothing.
`-y, --yes`	Don’t ask for confirmation.
`--reason <reason>`	Reason for the change, stored with the audit record.

Who can run it: a grant whose role has operate in the environment.

API: DELETE /api/v1/projects/{project}/secrets/{name}, DELETE /api/v1/environments/{environment}/projects/{project}/secrets/{name}, DELETE /api/v1/projects/{project}/integrations/{integration}/secrets/{name}, DELETE /api/v1/environments/{environment}/projects/{project}/integrations/{integration}/secrets/{name}.

Exit codes#

The commands on this page exit with the codes in the exit code table: 0 on success, 1 when the hub refuses a change, 2 for a usage error, 3 when the key is missing or not allowed, 4 when something isn’t found, 5 for a conflicting change, 6 when the hub can’t be reached and 8 when a document isn’t valid. weikio secret reveal exits 3 in an environment that doesn’t allow reveals and 6 when you have revealed too many secrets in a short time.

Variables and secrets

Commands on this page#

weikio get variables#

weikio describe variable#

weikio variable set#

weikio delete variable#

weikio get secrets#

weikio secret set#

weikio secret reveal#

weikio delete secret#

Exit codes#

See also#

`weikio get variables`#

`weikio describe variable`#

`weikio variable set`#

`weikio delete variable`#

`weikio get secrets`#

`weikio secret set`#

`weikio secret reveal`#

`weikio delete secret`#